[0day-rubbish] Devolutions Server (DVLS) 2026.2.14.0 PAM entitlement-gate bypass to SYSTEM PowerShell via the test-script endpoint (9.1)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-22 18:31 UTC
Importiert: 2026-09-22 19:12 UTC
Quelle-ID: full_disc
uid_hash: 9720fa1e2c2c273f29deb03868485a3f9ffc5a5058fd7fae3d4bdcc8dc508041

Full Disclosure

Posted by disclosure via Fulldisclosure on Sep 22 0day Rubbish Research Team is publicly disclosing a vulnerability in

Devolutions Server (DVLS) 2026.2.14.0.

Type: PAM entitlement-gate bypass to SYSTEM PowerShell via the test-script endpoint (CWE-862)

CVSS: 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

Impact: arbitrary PowerShell execution as NT AUTHORITY\SYSTEM on the Devolutions Server host

Authentication: authenticated administrator (no PAM licence, no PAM role)

Full technical analysis and a...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss