Devolutions Server Version 2026.3.8.0 (October 6, 2026)

Devolutions Server Version 2026.3.8.0 (October 6, 2026)

avatar
Devolutions

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version

IMPROVEMENTS

  • Core - Added a deprecation warning for sending SMS through email, planned for 2027.1, with a shortcut to configure Twilio

  • Core - Removed the option to export in the .rdm v1 format; exports now use v2, while v1 files can still be imported

  • PAM - Added the ability to select an SSH Key PAM account from the DVLS web interface

FIXES

  • SECURITY Core - Fixed an authorization issue that allowed low-privileged users to delete and restore vault attachments from the attachment history

  • SECURITY CVE-2026-105488 Core - Fixed an account takeover risk involving phishing through the device code authentication flow

  • SECURITY CVE-2026-105488 Core - Fixed an authorization issue that allowed unauthorized users to read, modify, or delete Global Contact and Folder entries

  • SECURITY CVE-2026-9226 Core - Fixed an account takeover risk where Azure AD login session tokens could be replayed

  • Core - Fixed an error when migrating legacy forbidden passwords to a vault

  • Core - Fixed an issue where filtered entry pickers only displayed root-level entries instead of entries inside folders

  • Core - Fixed an issue where the expired entries filter returned no results when filtering by folder or vault name

  • Core - Fixed an issue where the Tor exit node list was downloaded on every login even when "Block Tor clients" was disabled

  • Core - Multiple UI fixes

  • Gateway - Fixed an issue where sessions through a virtual gateway failed to launch when the entry was configured to prompt for credentials

  • PAM - Fixed an issue where "Exclude disabled accounts" became mandatory after editing a Windows Local Account provider in DVLS web

  • PAM - Fixed an issue where a port set to 0 wasn't replaced with the default port when using the SSH Key provider

  • PAM - Fixed an issue where Certificate entries couldn't be added when their value contained a backslash

  • PAM - Fixed an issue where previously selected JIT groups were removed when adding a new group through search

  • PAM - Fixed an issue where SSH key account discovery failed when an authorized key had no comment

  • PAM - Fixed an issue where the legacy WinRM client mode skipped TLS certificate validation for HTTPS hosts when "Skip TLS validation" was disabled

  • Web - Fixed an issue where users with Add but no Edit permission on a folder couldn't add a Document entry stored in the database

** CONSOLE RELEASE NOTES **

IMPROVEMENTS

  • Core - Improved installation and diagnostic checks to detect and report port reservations that could cause the site to return a 503 error

All Comments (0)