The vulnerability identified as CVE-2026-100289 involves missing authorization controls in the gateway network scan token API of Devolutions Server. Authenticated users with limited privileges can exploit this flaw to generate network scan tokens, enabling them to perform internal network discovery and port scanning through the gateway. This issue affects Devolutions Server versions prior to 2026.3.7.0. No CVSS score or detailed exploit information is available, and no official patch links have been provided.

An authenticated low-privileged user can bypass intended authorization restrictions to generate network scan tokens. This enables internal network discovery and port scanning, potentially exposing internal network topology and services to unauthorized users, which could aid in further attacks or reconnaissance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Devolutions Server to trusted users only and monitor for unusual API usage patterns related to network scanning activities.