CVE-2026-119636 Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.2

What is CVE-2026-119636?

CVE-2026-119636 is a high-severity vulnerability in Devolutions Server, published on 3 Nov 2026.

Official description

Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.

Weakness: CWE-772

Which versions are affected by CVE-2026-119636?

It affects 1 product.

Products include Devolutions Server.

How do I fix CVE-2026-119636?

No fix has been published for CVE-2026-119636 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-119636 being exploited?

There is no known exploitation of CVE-2026-119636 in the wild and no public exploit code.

Other vulnerabilities in Devolutions Server

• CVE-2026-3130 Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete per Critical 9.8
• CVE-2026-3204 Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the display Critical 9.8
• CVE-2026-3224 Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unaut Critical 9.8
• CVE-2026-0610 SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 Critical 9.8
• CVE-2024-2921 Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to t Critical 9.8

All Devolutions Server vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v65m-vc6q-3v2c.