CVE-2026-110804

{
  "etk_id": "ETK-2026-2251",
  "cve_id": "CVE-2026-110804",
  "display_id": "CVE-2026-110804",
  "ghsa_id": "GHSA-jhmq-jch2-cv3p",
  "euvd_id": "EUVD-2026-102876",
  "status": "published",
  "anchor_state": "anchored",
  "title": "JIT elevation setting manipulation in Devolutions Server PAM checkout",
  "summary": "Devolutions Server versions through 2026.3.8.0 can accept improperly controlled JIT elevation settings during PAM checkout updates. An authenticated user with PAM checkout access may be able to preserve elevated access or remove Active Directory groups.",
  "mitigation": "Upgrade Devolutions Server to version 2026.3.10. Limit PAM checkout access to trusted users until the update is complete.",
  "vendor": "Devolutions",
  "product": "Server",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 2026.3.10"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "2026.3.10"
      ],
      "package_name": "Server",
      "purl": null
    }
  ],
  "cwes": [
    915
  ],
  "cvss_score": 4.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 37.5348098,
  "t0_at": "2026-10-16T13:45:38.143000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-16T13:45:38.143000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T13:45:38.143000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-110804"
    }
  }
}