CVE-2026-10544

Description

Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

PUBLISHED Reserved 2026-06-01 | Published 2026-06-08 | Updated 2026-06-08 | Assigner DEVOLUTIONS

Problem types

CWE-78 Improper neutralization of special elements used in an OS command (OS command injection)

Product status

References

devolutions.net/security/advisories/DEVO-2026-0015/

cve.org (CVE-2026-10544)

nvd.nist.gov (CVE-2026-10544)

Download JSON