CVE-2026-14536 — Devolutions / Server

CVE-2026-14536

Devolutions / Server PUBLISHED

Description (CNA)

Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.

Affected (CNA)

Vendor / product	Versions
Devolutions / Server	affected 2026.2.4 before 2026.2.9

CWE

No CWE identifiers supplied.

References

https://devolutions.net/security/advisories/DEVO-2026-0023/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.