A high-severity authorization bypass vulnerability in Devolutions Server allows attackers with high privileges to circumvent network security controls, posing a significant risk to access integrity.

This vulnerability, identified as CWE-863, involves an incorrect authorization flaw within the virtual gateway component. The CVSS vector (AV:N/AC:L/PR:H/UI:N) indicates that an attacker must possess high privileges to trigger this bypass, which subsequently allows them to circumvent configured deny IP rules.

The ability to bypass IP allow-list or deny-list restrictions undermines the primary perimeter security of the Devolutions Server. Given the CVSS score of 7.6, this flaw represents a significant risk to the confidentiality and integrity of the system, potentially allowing an attacker to access sensitive management interfaces from unauthorized network locations. This could facilitate further exploitation or unauthorized administrative actions.

Immediate Action: Review the official security advisory at the Devolutions website for the release of a patched version and apply the update immediately upon availability.

Proactive Monitoring: Monitor server access logs for anomalous login attempts or traffic originating from IP addresses that should be restricted by the gateway configuration.

Compensating Controls: Ensure that additional network-level controls, such as VPN requirements or hardware-based firewalls, are in place to restrict access to the management gateway until the software is updated.

Public Exploit Available: Unknown.

This vulnerability presents a clear risk to the integrity of network access controls within Devolutions Server. Administrators should prioritize tracking the vendor advisory for patch availability and ensure that internal network access policies are strictly enforced through secondary controls while awaiting a formal software fix.