Devolutions Server Version 2026.3.8.0 (October 6, 2026)

Devolutions Server Version 2026.3.8.0 (October 6, 2026)

avatar
devolutions-automation

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version

IMPROVEMENTS

  • Core - Added a deprecation warning for sending SMS through email, planned for 2027.1, with a shortcut to configure Twilio
  • Core - Removed the option to export in the .rdm v1 format; exports now use v2, while v1 files can still be imported
  • PAM - Added the ability to select an SSH Key PAM account from the DVLS web interface


FIXES

  • SECURITY Core - Fixed an authorization issue that allowed low-privileged users to delete and restore vault attachments from the attachment history
  • SECURITY CVE-2026-105488 Core - Fixed an account takeover risk involving phishing through the device code authentication flow
  • SECURITY CVE-2026-105488 Core - Fixed an authorization issue that allowed unauthorized users to read, modify, or delete Global Contact and Folder entries
  • SECURITY CVE-2026-9226 Core - Fixed an account takeover risk where Azure AD login session tokens could be replayed
  • Core - Fixed an error when migrating legacy forbidden passwords to a vault
  • Core - Fixed an issue where filtered entry pickers only displayed root-level entries instead of entries inside folders
  • Core - Fixed an issue where the expired entries filter returned no results when filtering by folder or vault name
  • Core - Fixed an issue where the Tor exit node list was downloaded on every login even when "Block Tor clients" was disabled
  • Core - Multiple UI fixes
  • Gateway - Fixed an issue where sessions through a virtual gateway failed to launch when the entry was configured to prompt for credentials
  • PAM - Fixed an issue where "Exclude disabled accounts" became mandatory after editing a Windows Local Account provider in DVLS web
  • PAM - Fixed an issue where a port set to 0 wasn't replaced with the default port when using the SSH Key provider
  • PAM - Fixed an issue where Certificate entries couldn't be added when their value contained a backslash
  • PAM - Fixed an issue where previously selected JIT groups were removed when adding a new group through search
  • PAM - Fixed an issue where SSH key account discovery failed when an authorized key had no comment
  • PAM - Fixed an issue where the legacy WinRM client mode skipped TLS certificate validation for HTTPS hosts when "Skip TLS validation" was disabled
  • Web - Fixed an issue where users with Add but no Edit permission on a folder couldn't add a Document entry stored in the database


** CONSOLE RELEASE NOTES **

IMPROVEMENTS

  • Core - Improved installation and diagnostic checks to detect and report port reservations that could cause the site to return a 503 error

All Comments (0)