CVE-2026-14536 describes a vulnerability in Devolutions Server 2026.2.4 where the mandatory multi-factor authentication policy is not properly enforced. Specifically, when the server processes an invalid default MFA value, it allows an attacker who already has valid user credentials to bypass the MFA requirement and authenticate without completing the second factor. This issue is categorized under CWE-693 (Protection Mechanism Failure). No CVSS score or official remediation information is currently available.

An attacker with valid user credentials can bypass the mandatory MFA policy, potentially reducing the security of user accounts by allowing access without completing multi-factor authentication. This weakens the intended protection provided by MFA, increasing the risk of unauthorized access if credentials are compromised.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider additional compensating controls such as monitoring for suspicious login activity or restricting access based on network location or device trust. Avoid relying solely on the MFA enforcement in the affected version.