PT-2026-29538 · Devolutions · Devolutions Server

Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-4924

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Devolutions Server versions through 2026.1.11

Description A flaw exists in the two-factor authentication (2FA) feature that permits a remote attacker possessing valid credentials to circumvent multifactor authentication and obtain unauthorized access to a victim's account. This is achieved by reusing a partially authenticated session token.

Recommendations Update Devolutions Server to a version later than 2026.1.11.

Fix

Weakness Enumeration

CWE-1390

Related Identifiers

BDU:2026-04976

CVE-2026-4924

Affected Products

Devolutions Server

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-4924 · Security Note
• https://bdu.fstec.ru/vul/2026-04976 · Security Note
• https://devolutions.net/security/advisories/DEVO-2026-0010 · Vendor Advisory
• https://twitter.com/CVEnew/status/2039372045624988154 · Twitter Post