CVE-2026-10544

MediumCVSS 6.5/10Last modified Jul 23, 2026

Description

Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider.

This issue affects :

* Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Devolutions	Server	2026.2.4.0; <= 2026.1.20.0

References

https://devolutions.net/security/advisories/DEVO-2026-0015/Vendor Advisory

Timeline

Published: Jun 8, 2026
Last modified: Jul 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1054406.5Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated, low-privilege CVE-2026-1054427.5IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow CVE-2026-1054438.2IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.CVE-2026-1054446.3A security flaw has been discovered in dotnet eShop .NET 8. The impacted element is the function GetOrderAsync of the file src/Ordering.API/CVE-2026-1054459.4An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker CVE-2026-1054475.5A flaw was found in Quay. When handling build trigger requests, the application incorrectly exposes trigger configuration details containing CVE-2026-105457.5IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary e CVE-2026-1054525.9Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alte CVE-2026-1054538.4IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privi CVE-2026-1054545.3RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A URL crafted to CVE-2026-1054555.3RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident from a repor CVE-2026-1054565.3RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that merely conta