CVE-2026-4927

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-01 · updated 2026-10-26
Weakness: CWE-201

Description

Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.

Affected products

Devolutions Server: from 2026.1.6.0 before 2026.1.12.0 — fixed in 2026.1.12.0

How to fix

Upgrade to a fixed version: Devolutions Server 2026.1.12.0. Check the vendor advisory for mitigations.

References

https://devolutions.net/security/advisories/DEVO-2026-0010

Get alerted when CVE-2026-4927 or the next vulnerability affects your stack