Devolutions Server CVE-2026-100289

Requires an authenticated account on Devolutions Server (any low-privileged user suffices, per PR:L) and network reachability to the API. The specific prerequisite is that the deployment uses a Devolutions Server gateway capable of network scanning - the attacker abuses the gateway network scan token API, which fails to enforce authorization. Exploitation is limited by the need for valid low-privilege credentials and by the impact being reconnaissance only (internal host/port discovery), not data exfiltration or code execution. Affected versions: Devolutions Server 2026.3.5.0 and earlier; fixed in 2026.3.7.0.

This is a genuinely moderate, not high-priority, issue and the 5.0 CVSS reflects that accurately. The vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) shows a network-reachable, low-complexity flaw requiring only a low-privileged authenticated account and no user interaction - but the impact is limited to low confidentiality with no integrity or availability effect. All escalation signals point the same way: SSVC records Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial; there is no EPSS score, no CISA KEV listing, and no known POC. The flaw is essentially an authorization gap that turns the Devolutions Server gateway into an internal network reconnaissance/port-scanning proxy (SSRF-adjacent behavior), which explains the scope change (S:C) - the attacker leverages the gateway to reach systems behind it. Real-world risk is that of a lateral-movement enabler for an already-authenticated insider or a foothold attacker, not a direct compromise primitive. No conflicting signals between the CVSS vector and description; the description confirms authenticated low-privilege access, consistent with PR:L.

A low-privileged but authenticated Devolutions Server user (or an attacker who has phished/obtained such credentials) sends a crafted API request to the gateway network scan token endpoint, which fails to check authorization. Using the generated token, they drive the gateway to enumerate live hosts and open ports across the internal network it can reach, mapping targets for lateral movement. No public exploit code is identified at time of analysis, and there is no evidence of active exploitation.