Devolutions Server Version 2026.2.20.0 (October 15, 2026)

If you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version

FIXES

• SECURITY CVE-2026-110287 - Core - Fixed users without the Edit asset permission being able to change an asset's contact password
• SECURITY CVE-2026-110804 - PAM - Fixed JIT elevation cleanup at check-in relying on client-provided values, which could delete Active Directory groups DVLS did not create or leave elevated access in place
• SECURITY CVE-2026-110805 - Core - Fixed a vulnerability in PingOne group lookups that could allow server requests to arbitrary addresses and expose sensitive data
• SECURITY CVE-2026-110806 - Core - Fixed passwords stored in session add-on settings being visible to users without permission to view credentials
• Core - Fixed TLS syslog messages being silently dropped when the certificate was issued for a hostname
• Core - Fixed users disabled or revoked in Entra ID, Okta, or PingOne remaining signed in to DVLS

** CONSOLE RELEASE NOTES **

IMPROVEMENTS

• Minor update