PT-2026-42788 · Devolutions · Devolutions Server

CVE-2026-9047 · Published 2026-05-22 · Updated 2026-05-22

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2026.1.6.0 through 2026.1.16.0

Description Improper handling of factor key state in the multi-factor authentication management feature allows an attacker who knows a user's password to bypass multi-factor authentication after the user reconfigures their factors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-305

Related Identifiers

CVE-2026-9047

Affected Products

Devolutions Server

References · 2

• https://devolutions.net/security/advisories/DEVO-2026-0013 · Note
• https://t.me/CVEtracker/54636 · Telegram Post