CVE-2026-10544
Severity CVSS v4.0:
Pending analysis
Type:
CWE-78
OS Command Injections
Publication date:
08/06/2026
Last modified:
08/06/2026
Description
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider.<br />
<br />
This issue affects :<br />
<br />
* Devolutions Server 2026.2.4.0<br />
* Devolutions Server 2026.1.20.0 and earlier