Two records, one release, and a gap in between

CERT-BUND published WID-SEC-2026-3993 on 15 October 2026 with a medium risk rating and four CVE identifiers for Devolutions Server. NVD published its own records on 16 October 2026 with per-CVE descriptions, weakness classes and CVSS v3.1 scores. The fixed builds are 2026.3.10 and 2026.2.20.0.
Reading two databases at once is ordinary work for a vulnerability manager, and the differences in this case explain why a version check has to happen against the running system rather than against the advisory text.

What each source gives you

CERT-BUND supplies the product scope and the paired vulnerable and fixed references, naming releases below 2026.3.10 and below 2026.2.20.0. NVD supplies the technical detail: the PingOne groups endpoint SSRF under CVE-2026-110805 and CWE-918, the JIT elevation settings problem under CVE-2026-110804 and CWE-915, the add-on property authorization failure under CVE-2026-110806 and CWE-863, and the asset contact password access control issue under CVE-2026-110287 and CWE-863.
Neither source names a compromise. The NVD SSVC entries record exploitation as none and automatable as no for the four records, which describes activity at publication time and is not a forecast.

Where the ranges disagree

NVD lists two vulnerable ranges for the product: releases below 2026.2.20.0, and releases from 2026.3.5.0 up to 2026.3.10.0. The CVE descriptions say 2026.3.8.0 and earlier. A reader who takes the second range seriously and stops at the first number will patch correctly. A reader who assumes the newest build below 2026.3.10 is safe will leave the second range in place.
That gap is the practical lesson of the advisory pair. Fixed reference points do not always describe a single contiguous range, and a version that looks recent can still sit inside an affected window.

Verifying the upgrade

Read the version from the running service, not from the installer or the package name. Check standby nodes, snapshots and test copies that share configuration with production. Where the deployment runs inside a container or an image, confirm the image tag and the digest, because a rebuilt image can carry an old layer.
After the upgrade, confirm that the fixed behaviour is active. A patch that installed but did not restart leaves the old request handling in place, and PAM servers frequently run for months between restarts.

Exposure numbers, used honestly

ZoomEye returned 123 assets for app="Devolutions Server" when this article was prepared. That figure counts internet-visible fingerprints for the product. It cannot confirm a vulnerable build and it does not describe internal deployments, which is where most PAM servers live. The vul.cve="CVE-2026-110805" query returned no indexed results, which is normal this soon after publication and is not a measure of risk.

The follow-up that outlasts the ticket

Close the ticket with four answers recorded in it: the builds verified as patched, the PingOne secret rotated or confirmed absent, the add-on and asset passwords rotated where the audit trail is unclear, and the checkout configurations reviewed against policy. Those four lines are what an auditor will ask for next year, and they take minutes to write while the change window is open.

References

  • NVD, CVE-2026-110805: https://nvd.nist.gov/vuln/detail/CVE-2026-110805

  • NVD, CVE-2026-110804: https://nvd.nist.gov/vuln/detail/CVE-2026-110804

  • NVD, CVE-2026-110806: https://nvd.nist.gov/vuln/detail/CVE-2026-110806

  • NVD, CVE-2026-110287: https://nvd.nist.gov/vuln/detail/CVE-2026-110287

  • CERT-BUND, WID-SEC-2026-3993: https://wid.cert-bund.de/content/public/content/39e4983c-55a1-494e-9557-cd8aa7c1109a

  • Devolutions security advisories: https://devolutions.net/security/advisories/