CVE-2026-100289

Executive Summary

CVE-2026-100289 is a missing authorization vulnerability (CWE-862) in the gateway network scan token API of Devolutions Server 2026.3.5.0 and earlier. An authenticated but low-privileged user can invoke a crafted API request to mint a network scan token, which the gateway then uses to perform internal network discovery and port scanning on behalf of the requester. The impact is primarily a confidentiality and attack-surface exposure issue: a low-privilege foothold can be converted into a network-layer reconnaissance primitive that maps internal assets reachable through the gateway.

Technical Analysis

The flaw resides in the authorization logic governing the issuance of network scan tokens within Devolutions Server's gateway component. The affected endpoint is referred to in the advisory as the "gateway network scan token API." The core defect is a missing authorization check (CWE-862): the API is reachable and functionally usable by an authenticated user whose role should not permit the generation of scan tokens. Because the authorization decision is absent rather than merely weak, the request succeeds as long as the caller holds any valid authenticated session — privilege level is not evaluated before the token is issued.

The service then honors that legitimately-formed token by executing network-level operations through the gateway. This is the critical multiplier: the gateway is a component that sits at a trust boundary and is presumed to have network reach that the requesting client does not. An attacker does not need to originate scan traffic from their own host; they leverage the gateway's network position. The result is that the vulnerable component functions as an unintended proxy for probing the internal network segment to which the gateway has connectivity.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N is consistent with this mechanism. The attack is network-reachable (AV:N), requires no special conditions (AC:L), requires only low privileges (PR:L), needs no user interaction (UI:N), and is scoped as Changed (S:C) — the exploited gateway component impacts resources beyond its own security scope, namely the internal network it can reach. Confidentiality is rated Low (C:L) and Integrity/Availability are None (I:N/A:N), which aligns with reconnaissance: the attacker gains visibility (limited, indirect information about live hosts and open ports) without modifying or disrupting target systems.

Technical gaps in the available data: the advisory does not disclose the exact API route, the parameter names of the crafted request, or the token format. These details are intentionally omitted and should not be inferred. The precise set of internal operations a scan token authorizes is described only at the class level — internal network discovery and port scanning through the gateway — and the report treats it at that level accordingly.

Exploitation Scenarios

The attack chain for CVE-2026-100289, taken strictly from the advisory:

1. Reconnaissance / target identification. The attacker obtains low-privileged authenticated access to a Devolutions Server instance running 2026.3.5.0 or earlier. This is the sole precondition described; the advisory specifies no additional role, tenant, or configuration prerequisite beyond "authenticated low-privileged user." The attacker confirms the gateway feature is present and reachable.

2. Triggering the specific flaw class. The attacker sends a crafted API request to the gateway network scan token API. Because the endpoint performs no authorization check on the caller's privilege (CWE-862), the request is processed and a network scan token is returned despite the caller not being entitled to one. No privilege escalation exploit is required — the vulnerability is the outright absence of an access-control decision.

3. Payload / execution method at the vulnerability-class level. With a valid scan token in hand, the attacker directs the gateway to perform network operations. The gateway, operating from its own network position, performs internal network discovery and port scanning. The attacker reads the results to enumerate reachable hosts and open services on the internal segment the gateway can access — a segment the attacker's low-privileged account would not otherwise be able to probe. No public PoC is available; the attack chain is inferred from the vulnerability class (missing authorization on a token-issuing API) as described by the CNA.

4. Post-exploitation impact. The output is a network map: live internal hosts and open ports behind the gateway. This is an enablement primitive. The attacker uses the discovered inventory to select follow-on targets — for example, to prioritize unauthenticated or weakly protected services, to tailor additional exploitation, or to plan lateral movement. CVE-2026-100289 itself does not grant code execution, credential access, or persistence; it devalues network segmentation by allowing a low-privilege user to see through a component that was expected to confine their visibility.

Impact Assessment

The business impact centers on the erosion of network segmentation and the intelligence advantage gained by an attacker who already holds a low-privileged account. Devolutions Server is a privileged-access-management product, and its gateway is typically deployed to broker connectivity into restricted network segments. Allowing an unprivileged authenticated user to co-opt that gateway into a scanning proxy inverts the trust model: the very component intended to enforce least privilege becomes the instrument that bypasses it for reconnaissance purposes.

Blast radius is scoped by the gateway's network reach, not by the Devolutions Server host alone — this is why the CVSS scope is Changed (S:C). Any internal address space the gateway can route to becomes enumerable. Organizations with flat internal networks or with the gateway placed adjacent to management VLANs, hypervisors, database tiers, or OT/ICS segments face the widest exposure.

CVSS subscores: the attack vector is Network (AV:N) and complexity is Low (AC:L), meaning exploitation is straightforward for anyone with an account. Privileges required are Low (PR:L) — the defining characteristic of the flaw, since a higher-privileged account would not be a vulnerability. No user interaction is needed (UI:N). Confidentiality impact is Low (C:L) because the output is enumeration metadata rather than direct data theft, with zero Integrity and Availability impact (I:N, A:N). The aggregate base score is 5.0 (Medium).

Business consequences to weigh: exposure of internal topology and service inventory, increased effectiveness of subsequent targeted attacks, potential regulatory implications where network reconnaissance constitutes a reportable security event, and the reputational cost of a PAM vendor whose product can be repurposed against its own customers' networks. There is no evidence of active exploitation, CISA KEV listing, public PoC, or known threat-actor campaign in the available data.

Detection Guidance

Detection focuses on identifying low-privileged principals invoking scan-token issuance and on anomalous gateway-originated scanning. Because the authorization decision is missing server-side, effective detection must be behavioral and identity-aware. All rules below are illustrative and should be tuned to the environment's logging schema, product field names, and baseline network behavior; product-specific API paths and field names are not disclosed in the advisory and are therefore represented generically with placeholders where necessary.

Sigma Rule

title: Devolutions Server Gateway Network Scan Token Issued to Low-Privileged User (CVE-2026-100289)
id: 8b5f1c2e-2d4a-4e7b-9c31-dvlt10028900
status: experimental
description: Detects issuance of a gateway network scan token via the Devolutions Server gateway network scan token API, potentially abused by an authenticated low-privileged user for internal network discovery (CWE-862 missing authorization).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100289
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1595
  - attack.t1046
logsource:
  product: devolutions
  service: server
detection:
  selection_path:
    http.request.uri|contains:
      - '/gateway'
      - 'scan'
      - 'token'
  selection_action:
    event.action|contains:
      - 'scan token'
      - 'ScanToken'
      - 'network scan'
  filter_admin:
    user.role:
      - 'administrator'
      - 'gateway_admin'
  condition: (selection_path and selection_action) and not filter_admin
falsepositives:
  - Authorized administrators legitimately provisioning scan tokens
  - Administrative automation with service accounts mapped to admin roles
level: high

YARA Rule

rule CVE_2026_100289_Devolutions_ScanToken_LowPriv
{
    meta:
        description = "Detects HTTP request/response artifacts referencing gateway network scan token issuance for CVE-2026-100289 reconnaissance abuse"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100289"
        author = "valtersit.com"
        date = "2026-01-01"
        severity = "high"

    strings:
        $api1 = "network scan token" ascii nocase
        $api2 = "scanToken" ascii nocase
        $api3 = "ScanToken" ascii nocase
        $gw1  = "/gateway" ascii nocase
        $op1  = "port scan" ascii nocase
        $op2  = "network scan" ascii nocase
        $op3  = "discovery" ascii nocase

    condition:
        filesize < 2MB and
        (
            (any of ($api1, $api2, $api3)) and
            ($gw1) and
            (any of ($op1, $op2, $op3))
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-100289 Devolutions Server gateway network scan token API potential low-privilege token issuance"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"gateway"; nocase; http.uri; content:"scan"; nocase; http.uri; content:"token"; nocase; http.header; content:"Devolutions"; nocase; classtype:attempted-recon; reference:cve,2026-100289; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-100289; sid:2026010289; rev:1;)

Note: the URI fragments gateway, scan, and token are derived from the advisory's phrase "gateway network scan token API." The exact route is not published, so this signature keys on the descriptive fragments and should be validated against observed traffic before production deployment to avoid false positives.

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" and user.roles : ("low_privilege", "user", "operator") ]
  [ network where network.protocol == "http"
      and http.request.method == "POST"
      and wildcard(http.request.uri, "*gateway*scan*token*") ]

Splunk SPL Query

index=devolutions OR index=proxy OR index=web
| eval uri_lower=lower(coalesce(http_request_uri, uri, url, ""))
| eval role_lower=lower(coalesce(user_role, role, user, ""))
| where (match(uri_lower, "gateway") AND match(uri_lower, "scan") AND match(uri_lower, "token"))
| where NOT match(role_lower, "admin")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(role_lower) as roles
        values(uri_lower) as uris
        by src_ip, user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="devolutions,web,">
  <rule id="100289" level="12">
    <if_sid>31100</if_sid>
    <field name="url">gateway</field>
    <field name="url">scan</field>
    <field name="url">token</field>
    <description>CVE-2026-100289: Possible gateway network scan token API access by non-admin user (Devolutions Server).</description>
    <mitre>
      <id>T1595</id>
      <id>T1046</id>
    </mitre>
    <group>cve_2026_100289,recon,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED). No vendor fix, workaround, or authoritative patch reference was identified from any tracked source. The recommendations below are defensive measures, not confirmed fixes.

1. Immediate mitigations (compensating controls):

• Enforce authorization at the network and identity layer until the server-side check is fixed. Place a reverse proxy or API gateway in front of the Devolutions Server management interface and deny requests to the gateway network scan token API unless the caller holds an administrative role. Because the flaw is a missing server-side check, an external policy enforcement point is the most reliable interim control.
• Apply least privilege to Devolutions Server accounts. Audit all accounts with authenticated access and downgrade or remove any that do not require an active session. Since exploitation requires only a low-privileged authenticated user, reducing the population of valid sessions directly shrinks the exploitable surface.
• Restrict gateway network reach. Segment the gateway's network position so that even if a scan token is issued, the reachable address space is minimal. Place the gateway in a tightly scoped VLAN with deny-by-default egress to sensitive segments (management planes, hypervisors, database tiers, OT networks).
• Monitor and alert on scan-token issuance using the detection rules above; treat non-administrative issuance as a high-severity event.
• Enable detailed API and authentication logging on the Devolutions Server and preserve logs for retrospective analysis of any token issuance to low-privileged principals.

2. Patch / upgrade steps:

• No patched version is published in the available data. Monitor the Devolutions security advisory channel and the NVD entry for CVE-2026-100289 for an official fix and affected-version confirmation.
• Upon release of a fixed version, upgrade all Devolutions Server instances beyond the vulnerable range (currently documented as 2026.3.5.0 and earlier). Plan for a maintenance window with rollback capability.
• After upgrading, re-verify that the gateway network scan token API enforces role-based authorization by testing with a low-privileged account and confirming the request is rejected.

3. Long-term hardening:

• Adopt deny-by-default authorization on all token-issuing APIs; require explicit role checks at the controller/service layer for every operation that produces a capability token or triggers network activity.
• Implement centralized, immutable logging for token issuance with alerting on any issuance to non-privileged identities — treat token minting as a security-relevant event class.
• Enforce network segmentation and egress filtering around all PAM gateways so a compromised or misused gateway cannot become a scanning proxy into sensitive segments.
• Perform periodic adversarial testing of the gateway's authorization boundaries and include missing-authorization (CWE-862) test cases in regression suites for API endpoints.
• Maintain an asset inventory of gateway-adjacent networks and review which internal segments the gateway can route to, treating that list as part of the attack surface.

References

• NVD — CVE-2026-100289: https://nvd.nist.gov/vuln/detail/CVE-2026-100289
• CWE-862: Missing Authorization — https://cwe.mitre.org/data/definitions/862.html
• Devolutions Security Advisories (monitor for vendor fix and affected-version confirmation): https://devolutions.net/security/advisories/
• MITRE ATT&CK T1595 — Active Scanning: https://attack.mitre.org/techniques/T1595/
• MITRE ATT&CK T1046 — Network Service Discovery: https://attack.mitre.org/techniques/T1046/

Threat actor / exploit-in-the-wild status: No public proof-of-concept, no exploit code, no Nuclei template, no CISA KEV listing, and no known threat-actor campaign were identified in the available data. EPSS has not yet been scored by FIRST.org; no EPSS value is asserted. The vulnerability is currently assessed as UNPATCHED with no tracked vendor fix.