What’s Vulnerable › Vulnerabilities

CVE-2026-14536

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-06 · updated 2026-10-25
• Weakness: CWE-863

Description

Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.

Affected products

• Devolutions Server: from 2026.2.4.0 through 2026.2.9.0

References

• https://devolutions.net/security/advisories/DEVO-2026-0023/

Get alerted when CVE-2026-14536 or the next vulnerability affects your stack