PatchTheCVECVE-2026-110287: Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authe
17
Routine
MEDIUM 4.3UPGRADE
CVE-2026-110287 is a medium-severity flaw (CVSS 4.3) affecting devolutions server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 92%) |
| CISA exploited list | No |
| Weakness | CWE-863 |
| Published | 2026-10-16 |
| Last modified | 2026-10-23 |
Publisher (CNA): Devolutions Inc. · Vendor: devolutions
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
devolutions devolutions server UPGRADE
Affected: < 2026.2.20.0 · >= 2026.3.5.0 and < 2026.3.10.0
Fixed in: 2026.2.20.0, 2026.3.10.0
Safe to downgrade to: a release before 2026.3.5.0
1. Check installed version
apt-cache policy devolutions-server || rpm -q devolutions-server || devolutions-server --version
2. UPGRADE to 2026.2.20.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade devolutions-server
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade devolutions-server
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2026.3.5.0 (Debian / Ubuntu)
apt-cache madison devolutions-server
sudo apt install devolutions-server=<VERSION_BEFORE_2026.3.5.0>
sudo apt-mark hold devolutions-server
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list devolutions-server
sudo dnf downgrade devolutions-server-<VERSION_BEFORE_2026.3.5.0>
sudo dnf versionlock add devolutions-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-110804 MEDIUM 4.3 UPGRADE Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0
- CVE-2026-110805 LOW 2.6 UPGRADE Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an
- CVE-2026-110806 MEDIUM 6.5 UPGRADE Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authentica