How severe is CVE-2026-10544?

CVE-2026-10544 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2026-10544 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-10544?

CVE-2026-10544 primarily affects Devolutions Devolutions Server. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-10544?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-10544 have an EU (EUVD) identifier?

Yes. CVE-2026-10544 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35184.

When was CVE-2026-10544 published?

CVE-2026-10544 was published on 2026-06-08 and last updated on 2026-07-23.

CVE-2026-10544

CVE-2026-10544 is a medium-severity vulnerability in Devolutions Devolutions Server with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-78.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (8th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-35184
Weakness: CWE-78
Affected product: Devolutions Devolutions Server
Published: 2026-06-08
Last modified: 2026-07-23

Description

Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

Frequently asked questions

What is CVE-2026-10544?: Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
How severe is CVE-2026-10544?: CVE-2026-10544 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2026-10544 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (8th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-10544?: CVE-2026-10544 primarily affects Devolutions Devolutions Server. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-10544?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-10544 have an EU (EUVD) identifier?: Yes. CVE-2026-10544 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35184.
When was CVE-2026-10544 published?: CVE-2026-10544 was published on 2026-06-08 and last updated on 2026-07-23.

References

https://devolutions.net/security/advisories/DEVO-2026-0015/

Affected products (2)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
cpe:2.3:a:devolutions:devolutions_server:2026.2.4.0:*:*:*:*:*:*:*

More vulnerabilities in Devolutions Devolutions Server

CVE-2026-3224 — Critical (CVSS 9.8): Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and…
CVE-2026-3204 — Critical (CVSS 9.8): Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote…
CVE-2026-3130 — Critical (CVSS 9.8): Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated…
CVE-2026-0610 — Critical (CVSS 9.8): SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1…
CVE-2024-2921 — Critical (CVSS 9.8): Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated…
CVE-2021-23921 — Critical (CVSS 9.1): An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry…

All CVEs affecting Devolutions Devolutions Server →

Other CWE-78 (OS Command Injection) vulnerabilities

CVE-2026-100382 — Critical (CVSS 10.0): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia…
CVE-2026-77521 — Critical (CVSS 10.0): MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool,…
CVE-2026-82004 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…
CVE-2026-76197 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…
CVE-2026-76195 — Critical (CVSS 10.0): Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS…
CVE-2026-19188 — Critical (CVSS 10.0): A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The…

Browse all CWE-78 (OS Command Injection) vulnerabilities →