Improper MFA Bypass in Devolutions Server 2026.2.9.0

Executive Summary

This vulnerability in Devolutions Server versions 2026.2.4.0 through 2026.2.9.0 involves improper enforcement of a mandatory multi-factor authentication (MFA) policy.

An attacker who already has valid user credentials can bypass the MFA requirement and authenticate without completing the multi-factor authentication process.

The issue occurs when the server encounters an invalid default MFA value during authentication, which allows the bypass.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized access to your Devolutions Server by attackers who have valid user credentials but are not supposed to bypass multi-factor authentication.

Because MFA is bypassed, attackers can potentially access sensitive data or systems that rely on the server's authentication controls.

The vulnerability has a high severity with a CVSS score of 7.6, indicating a significant security risk.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability CVE-2026-14536 in Devolutions Server, you should upgrade your Devolutions Server to version 2026.2.11.0 or higher.

This update addresses the improper enforcement of the mandatory multi-factor authentication policy that allows attackers with valid credentials to bypass MFA.

Useful 0 Not Useful 0