CVE-2026-119636

The record

Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.

Affected packages

Related vulnerabilities

• CVE-2026-121391 FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in… CWE-772
• CVE-2026-115215 In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS… CWE-772
• CVE-2026-90870 A missing release of backend receiver sessions in the Ad Hoc Transfer component of… CWE-772
• CVE-2026-112200 P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session… CWE-772
• CVE-2026-115793 P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that… CWE-772
• CVE-2026-118262 Echo is a Go web framework. CWE-772
• CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or… CWE-772
• CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-772