Devolutions Server 2026.2.4 contains a vulnerability (CWE-693) involving improper enforcement of mandatory multi-factor authentication. When the server encounters an invalid default MFA value, it allows an attacker who already has valid user credentials to bypass the MFA requirement and authenticate without completing the second factor. This flaw undermines the security controls intended to protect user accounts by multi-factor authentication.

An attacker with valid user credentials can bypass the mandatory MFA policy, potentially gaining unauthorized access to the system without completing multi-factor authentication. This compromises the confidentiality and integrity of the affected system, as indicated by the CVSS vector (Confidentiality and Integrity impact are high, Availability is not impacted).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published by the vendor at this time. Users should monitor Devolutions advisories for updates and consider additional compensating controls to protect accounts requiring MFA until a fix is available.