This vulnerability (CWE-918) in Devolutions Server arises from improper authorization in the Active Directory browsing feature. It enables a low-privileged authenticated user to perform SSRF attacks by relaying authentication credentials of a stored PAM provider service account to an attacker-controlled server. The affected versions include 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The issue was published on 2026-05-22, but no CVSS score or official remediation level has been assigned or disclosed by the vendor. The product is not a cloud service, so remediation depends on vendor patching.

An attacker with low-privileged authenticated access can obtain authentication material for a PAM provider service account by exploiting SSRF via the Active Directory browsing feature. This could potentially allow unauthorized access or privilege escalation depending on how the stolen credentials are used. However, no known exploits are reported in the wild, and the exact impact depends on the environment and attacker capabilities.

No official patch or remediation guidance is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict low-privileged user access to the Active Directory browsing feature if possible and monitor for unusual authentication relay activity.