CVE-2026-93330
Received Received - Intake

Improper PAM Rule Bypass in Devolutions Server

Publication date: 2026-09-29

Last updated on: 2026-09-29

Assigner: Devolutions Inc.

Description
Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-29
Last Modified
2026-09-29
Generated
2026-09-29
AI Q&A
2026-09-29
EPSS Evaluated
N/A
NVD
CVE-2026-93330
EUVD
EUVD-2026-88982

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
devolutions server 2026.3.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-696 The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may produce resultant weaknesses.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper enforcement of rules in the PAM Active Directory provider of Devolutions Server 2026.3.5. A user with PAM edit permissions can bypass the Devolutions Gateway host ruleset, potentially allowing unauthorized access or actions.

Impact Analysis

An attacker with PAM edit permissions could bypass security rules, leading to unauthorized access to systems or data. This may result in data breaches, privilege escalation, or compliance violations depending on the environment.

Compliance Impact

This vulnerability could lead to unauthorized access, which may violate compliance requirements such as GDPR (data protection) or HIPAA (healthcare data security). Organizations using Devolutions Server may face penalties or audit failures due to insufficient rule enforcement.

Mitigation Strategies

Update Devolutions Server to a version that fixes the PAM Active Directory provider rule enforcement issue. Review and restrict PAM edit permissions to only necessary users. Verify Devolutions Gateway host rulesets are correctly enforced.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93330. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart