Devolutions Server Improper Enforcement of Behavioral Controls Vulnerability Allowing Unauthorized PAM Account Deletion

A vulnerability exists in Devolutions Server versions through 2025.3.15 that allows an authenticated attacker with delete permissions to improperly delete Privileged Access Management (PAM) accounts. This is achieved by selecting a checked-out account alongside at least one non-checked-out account and performing a bulk deletion. This flaw bypasses intended safeguards, disrupts Just-in-Time (JIT) privilege revocation, and could lead to persistent elevated privileges.

Impact

Exploitation of this vulnerability could result in the unauthorized deletion of PAM accounts, particularly those currently checked out, potentially allowing for the retention of elevated privileges.

Remediation

Users are advised to upgrade to Devolutions Server version 2025.3.16 or 2026.1.