Cyber Resilience

CVE-2026-1007

High

Published: 19 January 2026

Published
19 January 2026
Modified
10 February 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
EPSS Score 0.0004 14.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-1007 is a high-severity Incorrect Authorization (CWE-863) vulnerability in Devolutions Devolutions Server. Its CVSS base score is 7.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement).

Deeper analysis

CVE-2026-1007 is an Incorrect Authorization vulnerability (CWE-863) in the virtual gateway component of Devolutions Server. It enables attackers to bypass deny IP rules. The issue affects Devolutions Server versions from 2025.3.1 through 2025.3.12 and was published on 2026-01-19T15:15:50.220 with a CVSS v3.1 base score of 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N).

Attackers with high privileges can exploit this vulnerability over the network with low complexity and no user interaction. Exploitation changes scope, resulting in low confidentiality impact and high integrity impact, specifically by bypassing IP deny rules.

Mitigation details are available in the Devolutions security advisory at https://devolutions.net/security/advisories/DEVO-2026-0003/.

EU & UK References

Vulnerability details

Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.

CWE(s)
CWE-863

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Incorrect authorization bypass in exposed virtual gateway directly enables remote exploitation of public-facing server component to circumvent IP-based access controls.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-0610Same product: Devolutions Devolutions Server
CVE-2026-3204Same product: Devolutions Devolutions Server
CVE-2025-2003Same product: Devolutions Devolutions Server
CVE-2026-4828Same product: Devolutions Devolutions Server
CVE-2025-2280Same product: Devolutions Devolutions Server
CVE-2026-4924Same product: Devolutions Devolutions Server
CVE-2025-2277Same product: Devolutions Devolutions Server
CVE-2026-3224Same product: Devolutions Devolutions Server
CVE-2026-3130Same product: Devolutions Devolutions Server
CVE-2026-4434Same product: Devolutions Devolutions Server

Affected Assets

devolutions
devolutions server
2025.3.1.0 — 2025.3.14.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match
prevent

AC-3 mandates enforcement of approved authorizations, directly countering the incorrect authorization flaw in the virtual gateway that bypasses deny IP rules.

AC-4 Information Flow Enforcement good match
prevent

AC-4 enforces approved information flows within systems, specifically mitigating the bypass of IP-based deny rules in the virtual gateway component.

SC-7 Boundary Protection good match
prevent

SC-7 monitors and controls communications at boundaries, providing layered IP filtering to prevent unauthorized access despite the authorization bypass vulnerability.

References