Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

[0day-rubbish] Devolutions Server (DVLS) 2026.2.14.0 PAM entitlement-gate bypass to SYSTEM PowerShell via the test-script endpoint (9.1)

Full Disclosure ()2
Read at seclists.org
AI summary · grok-4.7Summaries by Vani AI

Authenticated Devolutions Server admins can bypass PAM checks and run SYSTEM PowerShell via a test-script endpoint.

0day Rubbish Research Team disclosed a missing-authorization flaw in Devolutions Server (DVLS) 2026.2.14.0. An authenticated administrator who lacks a PAM licence and PAM role can bypass the PAM entitlement gate and run arbitrary PowerShell as NT AUTHORITY\SYSTEM through the test-script endpoint (CWE-862). CVSS is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). A reproducible proof-of-concept is claimed; the post does not assign a CVE or report exploitation in the wild.

Key facts
  • Affects Devolutions Server (DVLS) 2026.2.14.0.
  • Administrator without a PAM licence or PAM role can reach the test-script endpoint.
  • Bypass yields arbitrary PowerShell as NT AUTHORITY\SYSTEM; CVSS 9.1.
  • Requires high privileges; no CVE or in-the-wild exploitation stated.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1078 Valid AccountsT1059.001 PowerShell
Tags
devolutionsdvlspamprivilege-bypasspowershellrcepoc
Vendors
Devolutions
Products
Devolutions Server
Organizations
0day Rubbish Research Team

From the original article

Posted by disclosure via Fulldisclosure on Sep 22 0day Rubbish Research Team is publicly disclosing a vulnerability in Devolutions Server (DVLS) 2026. 2. 14.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.