Devolutions Server CVE-2026-105485

Exploitation requires that the target deployment uses the OAuth device authorization (device code) flow, and that the attacker first obtains a valid, still-replayable device verification link tied to a victim. The attack then depends on an already-authenticated victim actively replaying that captured link (UI:R) - the attacker cannot complete it alone. Limiting factors: HIGH attack complexity (AC:H) due to the need to capture a valid link and time the replay, mandatory victim interaction, and applicability only to Devolutions Server versions 2026.3.7.0 and earlier (fixed in 2026.3.8). No standing authentication is needed by the attacker (PR:N), but the dependency on victim behavior and link capture substantially narrows realistic exploitation.

This is a moderate-severity account-takeover flaw whose signals are largely consistent and point to limited, non-widespread risk. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, base 6.8) describes a network-reachable, unauthenticated attacker (PR:N) but with HIGH attack complexity (AC:H) and required user interaction (UI:R) - the attacker must capture a victim's device verification link and rely on an authenticated victim to replay it, which are meaningful real-world barriers. CISA SSVC reinforces this: Exploitation=none (no observed or public exploitation), Automatable=no (cannot be reliably scripted at scale, consistent with AC:H + UI:R), though Technical Impact=total (full account compromise, consistent with C:H/I:H). There is no EPSS score in the provided data, no CISA KEV listing, and no indication of public exploit code. The combination of AC:H, UI:R, SSVC Automatable=no, and the specific OAuth device-flow prerequisite means that despite 'total' technical impact this is a targeted, conditions-dependent issue rather than a mass-exploitation priority. Priority is driven mainly by the sensitivity of the product (a privileged-access/credential server) rather than by ease of exploitation. No EPSS value is available, so exploitation probability cannot be quantified from the input.

An attacker intercepts or otherwise captures a device verification link generated during Devolutions Server's OAuth device authorization flow, then induces an already-authenticated victim to replay (click/submit) that captured link, binding the attacker's device/session to the victim's account and resulting in account takeover. The high attack complexity (AC:H) and required victim interaction (UI:R) mean this is an opportunistic or targeted attack rather than a drive-by exploit. No public exploit code is identified at time of analysis.