PT-2026-29540 · Devolutions · Devolutions Server

Published 2026-04-01 · Updated 2026-04-01 · CVE-2026-4927

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.1.6 through 2026.1.11

Description A flaw exists in the users MFA feature of Devolutions Server that allows users with user management privileges to obtain other users' OTP keys through an authenticated API request.

Recommendations Update Devolutions Server to a version later than 2026.1.11.

Fix

Weakness Enumeration

CWE-201

Related Identifiers

CVE-2026-4927

Affected Products

Devolutions Server

References · 3

• https://devolutions.net/security/advisories/DEVO-2026-0010 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4927 · Security Note
• https://twitter.com/CVEnew/status/2039372044312158574 · Twitter Post