CVE-2026-14536 devolutions server vulnerability

Who is affected

How to fix it

Devolutions Server is affected by CVE-2026-14536, a MFA bypass risk. Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The recommended remediation is to update to Devolutions Server 2026.2.9 or the later fixed build listed in DEVO-2026-0023. Until the update is complete, enforce MFA through a known-valid default MFA configuration and restrict access for accounts that can bypass required MFA, review logs, and reduce exposure of the affected service, library, appliance, or trusted firmware path.

1. Inventory every deployment, package, appliance, service, application dependency, trusted firmware image, and managed environment that uses Devolutions Server.
2. Confirm the installed version/build and compare it with the affected versions listed in the source advisory and the source advisory for CVE-2026-14536.
3. Apply the vendor-supported fix: update to Devolutions Server 2026.2.9 or the later fixed build listed in DEVO-2026-0023.
4. If the update cannot be applied immediately, enforce MFA through a known-valid default MFA configuration and restrict access for accounts that can bypass required MFA; disable unnecessary public access, file processing, authentication integrations, upload endpoints, or high-risk features until patched.
5. Review application, appliance, reverse-proxy, WAF, package manager, authentication, trusted firmware, and audit logs for activity related to CVE-2026-14536.
6. Rotate sessions, API tokens, service credentials, integration keys, signing keys, and administrator passwords if logs or affected data indicate compromise, code execution, credential exposure, or unauthorized access.
7. Clear caches, restart affected services, rebuild affected containers or firmware images when appropriate, and remove temporary files, uploaded artifacts, stored payloads, or unsafe configuration created during exploitation attempts.

Verify the fix

• Confirm Devolutions Server now reports Devolutions Server 2026.2.9 or the later fixed build listed in DEVO-2026-0023 or a later vendor-supported fixed release/build for the deployed branch.
• Verify the affected workflow no longer allows the behavior described in CVE-2026-14536, using a safe regression test, vendor validation method, dependency inventory, or appliance health check.
• Review logs after remediation for continued exploit attempts, authentication anomalies, denial-of-service symptoms, suspicious uploads, file access, deserialization attempts, or configuration changes.
• Rerun a Fixnx scan and any product-specific scanner, package audit, firmware inventory, appliance health check, or manual regression test relevant to the affected service.
• Document affected assets, fixed versions, mitigation decisions, validation evidence, and any cleanup, rebuild, or credential rotation performed.

Trusted references

FAQ