Devolutions Server Version 2026.3.10.0 (October 15, 2026)

If you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version

FIXES

• SECURITY CVE-2026-110287 - Core - Fixed users without the Edit asset permission being able to change an asset's contact password
• SECURITY CVE-2026-110804 - PAM - Fixed JIT elevation cleanup at check-in relying on client-provided values, which could delete Active Directory groups DVLS did not create or leave elevated access in place
• SECURITY CVE-2026-110805 - Core - Fixed a vulnerability in PingOne group lookups that could allow server requests to arbitrary addresses and expose sensitive data
• SECURITY CVE-2026-110806 - Core - Fixed passwords stored in session add-on settings being visible to users without permission to view credentials
• Core - Fixed the Console's SQL Server workspace migration reporting "The database does not exist" after a successful connection test
• Core - Fixed TLS syslog messages being silently dropped when the certificate was issued for a hostname
• Core - Fixed trial options appearing unavailable after the first administrator login on a new installation
• Core - Fixed users disabled or revoked in Entra ID, Okta, or PingOne remaining signed in to DVLS
• Core - Fixed various user interface issues
• Gateway - Fixed credential injection and credential group restrictions being skipped when a gateway farm became the default gateway
• PAM - Fixed Cisco account password resets failing due to a missing required component
• PAM - Fixed Cisco password resets failing when the password contained special characters
• PAM - Fixed inherited account lifecycle policies displaying default settings instead of the provider's settings
• PAM - Fixed MySQL account password resets failing
• PAM - Fixed the custom Windows accounts provider failing when using linked credentials

** CONSOLE RELEASE NOTES **

FIXES

• Minor update