CVE-2026-100289
Received Received - Intake

Missing Authorization in Devolutions Server Allows Network Scanning

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Devolutions Inc.

Description
Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-100289
EUVD
EUVD-2026-89026

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
devolutions server to 2026.3.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves missing authorization in the gateway network scan token API of Devolutions Server versions 2026.3.5.0 and earlier. An authenticated user with low privileges can exploit this to generate a network scan token and perform internal network discovery and port scanning through the gateway by sending a specially crafted API request.

Detection Guidance

Detecting this vulnerability requires checking for unauthorized network scan tokens generated via the gateway API. Monitor API logs for unusual token generation requests from low-privileged users. Inspect network traffic for unexpected port scanning activities originating from the Devolutions Server gateway.

Impact Analysis

This vulnerability allows an attacker to scan internal networks and discover open ports, potentially exposing sensitive services or systems. It could lead to further exploitation if vulnerable services are identified, increasing the risk of data breaches or unauthorized access.

Compliance Impact

This vulnerability could violate compliance requirements such as GDPR or HIPAA by enabling unauthorized network scanning and potential exposure of sensitive data. It undermines security controls designed to protect personal or health information and may result in regulatory penalties.

Mitigation Strategies

Upgrade Devolutions Server to a version later than 2026.3.5.0 to address the missing authorization issue. Restrict API access to only necessary users and implement strict input validation for token generation requests. Review and revoke any suspicious tokens already generated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart