Devolutions Server Version 2026.2.18.0 (September 29, 2026)

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version

FIXES

• SECURITY Core - Fixed a security issue where the legacy partial login endpoint accepted and retained client-supplied session identifiers after authentication
• SECURITY Core - Fixed a SQL injection vulnerability in the database backup path setting
• SECURITY Core - Fixed an issue where low-privileged users could restore and permanently delete vault attachments through attachment history
• SECURITY Core - Fixed authentication and session tokens being stored unencrypted in the database
• SECURITY Core - Fixed integration secrets in data source settings being visible to users without administrative permissions
• SECURITY Core - Fixed missing access controls that allowed users without the required permissions to read or save System Vault entries
• SECURITY Core - Fixed the Microsoft Entra ID application secret being exposed in URL query strings when retrieving groups and role templates
• SECURITY Gateway - Fixed a security issue where any authenticated user could obtain a network scan token and access internal network information
• SECURITY PAM - Fixed domain controller detection occurring before the Devolutions Gateway ruleset was enforced, allowing network traffic to bypass the ruleset and gateway logging
• SECURITY PAM - Fixed the legacy WinRM client mode ignoring the "Skip TLS certificate validation" setting and always skipping certificate validation for HTTPS hosts
• Core - Fixed the "dvls-admin" user on Basic installations being able to bypass the required password change by closing the browser
• Core - Fixed users without System Vault entry edit permission being able to edit System Vault entries through their regular entry permissions
• Web - Fixed trailing spaces being saved in tags and "Exact expression" notification subscription filters despite appearing to be removed in the interface

** CONSOLE RELEASE NOTES **

IMPROVEMENTS

• Minor update