Devolutions Server PAM keeps account access after checkout expires

Accounts borrowed from an admin account manager can still be used after expiry.

Summary

In the PAM scheduled check-in task of Devolutions Server, expired checkouts are not released, so an authenticated user with checkout rights can keep access to the target account after it expires. Versions from 2025.3.2.0 through 2026.2.22.0 are affected.

Affected when

Authenticated user with checkout rights on a PAM account
Backlog of 21 or more newer active checkouts

What to do

Check that the server runs a version newer than 2026.2.22.0, and read the vendor's advisory. No fixed version is named in the sources.

Products and platforms

Devolutions Server

CVE IDs

CVE-2026-119636 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 20:39 UTC

First seen 2026-11-09 14:50 UTC