CVE-2026-11890

EUVD-2026-37200
Improper access control in PAM account discovery results in Devolutions 
Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve 
account discovery scan results.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 14%
Affected Products (NVD)
VendorProductVersion
devolutionsdevolutions_server
𝑥
< 2026.1.22.0
devolutionsdevolutions_server
2026.2.4.0 ≤
𝑥
< 2026.2.7.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://devolutions.net/security/advisories/DEVO-2026-0017/