CVE-2026-93330

Executive Summary

CVE-2026-93330 is an improper rule-enforcement vulnerability (CWE-696) in the PAM Active Directory provider of Devolutions Server 2026.3.5. An authenticated user holding PAM edit permissions can bypass the Devolutions Gateway host ruleset, defeating the network-access restrictions the PAM solution is designed to enforce. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3), the impact is scoped to a low-confidentiality loss affecting only the vulnerable component, with no integrity or availability impact and no exploit code or PoC publicly identified at the time of writing.

Technical Analysis

The vulnerability resides in the Privileged Access Management (PAM) module of Devolutions Server 2026.3.5, specifically in the Active Directory provider that PAM uses to resolve, broker, and authorize privileged sessions. The Devolutions Gateway component enforces a "host ruleset" — a policy layer that constrains which hosts a brokered session is permitted to reach. Per CWE-696 (Incorrect Behavior Order), the flaw is a rule-enforcement ordering/sequencing defect: a policy check is evaluated in the wrong order, skipped, or evaluated against an unauthorized trust context, allowing the host ruleset decision to be bypassed rather than properly applied.

The attack surface is a remote, network-reachable management interface (AV:N). The attacker must already be authenticated and must hold PAM edit permissions (PR:L). No user interaction is required (UI:N). Because the flaw is a logic/enforcement defect rather than memory corruption, exploitation does not depend on input fuzzing or a malformed payload — it depends on abusing a legitimate but insufficiently constrained privileged workflow. The confidentiality-only impact (C:L) with scope unchanged (S:U) is consistent with a bypass that exposes restricted host/AD information or establishes connectivity that policy was intended to deny, without granting a new privilege tier or affecting system availability.

Technical specifics beyond the CNA/NVD description — exact XML/JSON rule structures, the AD provider method names, the Gateway ruleset schema fields, or the precise ordering position that is violated — are not disclosed and cannot be confirmed from available data. No CVE description, CNA title, file path, function name, endpoint, or parameter is provided beyond the wording quoted above; accordingly, no implementation-level identifiers are asserted here. Readers should treat the mechanism as a policy-enforcement bypass in the PAM-to-Gateway authorization path and validate the exact condition against the vendor's eventual fix.

Exploitation Scenarios

No public PoC or exploit code is available. The attack chain below is inferred strictly from the vulnerability class (improper rule enforcement / incorrect behavior order) and the NVD description; it does not rely on any fabricated function, endpoint, or parameter names.

1. Reconnaissance / target identification. The attacker identifies an exposed Devolutions Server 2026.3.5 instance and confirms the PAM module and Devolutions Gateway are in use. This is an authenticated-attack scenario: the adversary must first hold a valid account that has been granted PAM edit permissions, either legitimately (insider, over-privileged operator) or via prior credential compromise.

2. Triggering the flaw class. Using their PAM edit permissions, the attacker manipulates PAM configuration objects that interact with the host ruleset enforcement path — for example, editing a PAM entry or association such that the rule evaluation for the Devolutions Gateway host ruleset is ordered incorrectly or reaches a state where the constraint is not applied. Because CWE-696 is an enforcement-ordering defect, the attacker does not need to inject malicious input; they create a configuration or workflow state that the authorization logic mishandles, allowing the intended host restriction to be skipped.

3. Payload / execution method. At the vulnerability-class level, the "payload" is a legitimate PAM authoring action that alters policy state, not a crafted exploit blob. When a brokered session is subsequently launched, the Gateway fails to enforce the host ruleset as intended, so the session reaches a host that should have been denied.

4. Post-exploitation impact. The attacker gains the ability to connect to or access hosts outside the sanctioned ruleset for brokered privileged sessions, expanding reach beyond the PAM boundary. Given the CVSS confidentiality-only, low-impact scoring, the practical result is information exposure or unauthorized reachability through the PAM/Gateway channel rather than code execution, persistence, or denial of service. The scope remains confined to the vulnerable component.

Prerequisites are non-trivial: authentication plus PAM edit permissions, and a deployment where the Devolutions Gateway host ruleset is relied upon as a security boundary. This limits the attack to insider or already-compromised privileged users rather than unauthenticated external actors.

Impact Assessment

Business impact centers on the erosion of the policy boundary that privileged-access management is purchased to provide. The Devolutions Gateway host ruleset is a compensating control that limits where brokered sessions can go; bypassing it means an organization's assumed "least privilege / restricted host" posture may not hold for users with PAM edit rights. For regulated environments (finance, healthcare, government) relying on PAM to satisfy segmentation and access-control requirements, this is a control-failure with audit and compliance implications.

Affected systems: Devolutions Server 2026.3.5 instances using the PAM Active Directory provider together with Devolutions Gateway ruleset enforcement. Blast radius is bounded by the CVSS subscores — Network vector (remotely reachable), Low privileges required, No user interaction, Scope Unchanged, Confidentiality Low, Integrity None, Availability None — yielding a moderate base score of 4.3. There is no evidence of wormable or self-propagating behavior, no integrity or availability impact, and no CISA KEV listing; the flaw is not currently known to be exploited in the wild. EPSS has not been scored by FIRST.org, so no probability estimate is asserted.

Detection Guidance

Sigma Rule

title: Potential Devolutions PAM Gateway Host Ruleset Bypass (CVE-2026-93330)
id: 7c9f1a2e-9333-4a10-8d5b-devolutions2026
status: experimental
description: Detects PAM configuration changes by a user that may bypass the Devolutions Gateway host ruleset in Devolutions Server 2026.3.5
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93330
author: valtersit.com
date: 2026/03/01
logsource:
  product: devolutions
  service: pam
detection:
  selection_event:
    event.action:
      - 'pam.edit'
      - 'pam.update'
      - 'gateway.ruleset.modify'
      - 'pam.adprovider.update'
  selection_priv:
    user.privilege: 'PAM_EDIT'
  condition: selection_event and selection_priv
fields:
  - user.name
  - source.ip
  - event.action
  - pam.entry
falsepositives:
  - Legitimate PAM administrators performing authorized policy maintenance
level: medium

YARA Rule

rule CVE_2026_93330_Devolutions_PAM_RuleEnforcement
{
    meta:
        description = "Detects strings associated with Devolutions Server PAM Gateway host ruleset bypass (CVE-2026-93330)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93330"
        date = "2026-03-01"
        severity = "medium"

    strings:
        $s1 = "Devolutions Gateway" ascii nocase
        $s2 = "host ruleset" ascii nocase
        $s3 = "PAM Active Directory provider" ascii nocase
        $s4 = "Devolutions Server 2026.3.5" ascii

    condition:
        uint16(0) == 0x5A4D or (2 of ($s1,$s2,$s3,$s4))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93330 Devolutions PAM Gateway host ruleset bypass attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"pam"; nocase; http.uri; content:"gateway"; nocase; http.uri; content:"ruleset"; nocase; classtype:attempted-admin; reference:cve,2026-93330; sid:202693330; rev:1;)

Elastic Detection

sequence by user.name with maxspan=10m
  [ authentication where event.outcome == "success" ]
  [ any where event.category == "configuration" and
      event.action in ("pam.edit", "pam.update", "gateway.ruleset.modify") ]

Splunk SPL Query

index=devolutions sourcetype=devolutions:pam
| search (event_action="pam.edit" OR event_action="pam.update" OR event_action="gateway.ruleset.modify"
          OR event_action="pam.adprovider.update")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(event_action) as actions by user, src_ip, pam_entry
| where count > 0
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"),
       last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="devolutions,pam,">
  <rule id="933301" level="8">
    <decoded_as>json</decoded_as>
    <field name="event.action">pam\.(edit|update|adprovider\.update)</field>
    <description>CVE-2026-93330: Potential Devolutions PAM ruleset bypass - PAM edit activity detected</description>
    <mitre>
      <id>T1548</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor workaround or fixed version is currently documented for this CVE.

1. Immediate mitigations

   • Treat the Devolutions Gateway host ruleset as non-authoritative until a fix ships. Restrict PAM edit permissions to the smallest possible set of trusted administrators, and review who currently holds them.
   • Enforce host-level network segmentation and firewall rules between brokered sessions and downstream systems, so that bypassing the ruleset does not translate into actual reachability.
   • Enable and centrally collect Devolutions Server & PAM audit logs (as reflected in the detection rules above) to catch anomalous PAM/gateway configuration changes.
   • If the Gateway host ruleset is a hard regulatory boundary for your organization, consider suspending or isolating affected PAM brokering workflows until a vendor fix is available.

2. Patch / upgrade steps

   • Monitor Devolutions' official release notes and security advisories for a fixed Devolutions Server build above 2026.3.5 that addresses CVE-2026-93330.
   • When a fix is published, test in a non-production environment, verify the host ruleset enforcement behaves correctly, then upgrade and re-validate PAM/Gateway policy.
   • Do not rely on unfixed third-party workarounds presented as patches; validate any guidance against the vendor directly.

3. Long-term hardening

   • Apply least-privilege and separation-of-duties to PAM configuration roles; require change approval for ruleset-affecting edits.
   • Baseline expected host-ruleset state and alert on deviations.
   • Adopt defense-in-depth so that no single logic control in the PAM/Gateway path is the sole boundary protecting privileged hosts.

References

• NVD — CVE-2026-93330: https://nvd.nist.gov/vuln/detail/CVE-2026-93330
• CWE-696 — Incorrect Behavior Order: https://cwe.mitre.org/data/definitions/696.html
• MITRE ATT&CK — T1548 Abuse Elevation Control Mechanism: https://attack.mitre.org/techniques/T1548/
• Devolutions product/security advisories: https://devolutions.net/security/advisories/
• CISA Known Exploited Vulnerabilities Catalog (CVE not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-93330 at the time of writing. No public PoC, Nuclei template, or exploit code has been identified, and EPSS has not yet been scored by FIRST.org.