CVE-2026-10544
published 2026-06-08CVE-2026-10544: Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with…
PriorityP341medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.20%
9.5th percentile
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| devolutions | devolutions_server | < 2026.1.21.0 | 2026.1.21.0 |
| devolutions | devolutions_server | — | — |
| devolutions | server | <= 2026.1.20.0 | — |
| devolutions | server | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrar
ghsa_unreviewed·2026-06-08
CVE-2026-10544 [MEDIUM] CWE-78 Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrar
Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider.
This issue affects :
* Devolutions Server 2026.2.4.0
* Devolutions Server 2026.1.20.0 and earlier
VulDB
Devolutions Server up to 2026.1.20.0/2026.2.4.0 os command injection (DEVO-2026-0015)
vuldb·2026-06-08·CVSS 6.5
CVE-2026-10544 [MEDIUM] Devolutions Server up to 2026.1.20.0/2026.2.4.0 os command injection (DEVO-2026-0015)
A vulnerability identified as critical has been detected in Devolutions Server up to 2026.1.20.0/2026.2.4.0. The affected element is an unknown function. The manipulation leads to os command injection.
This vulnerability is uniquely identified as CVE-2026-10544. The attack is possible to be carried out remotely. No exploit exists.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-08
Published