Devolutions Server CVE-2026-105488

Exploitation requires an authenticated Devolutions Server account (PR:L) that has been granted the global-vault 'view' permission; with that permission the missing authorization check lets the user modify and delete global contact and folder entries they should only be able to read. Limiting factors: the attacker must already possess valid credentials and the specific view grant on the global vault, affected builds are 2026.3.7.0 and earlier (fixed in 2026.3.8), and there is no anonymous/unauthenticated path and no user-interaction vector for a third party to trigger it. This makes it predominantly an insider or compromised-account privilege-boundary risk rather than broad remote exploitation.

This is a genuine but moderate-priority access-control flaw, not a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N, 7.1 HIGH) describes a network-reachable, low-complexity attack requiring low privileges (PR:L) and no user interaction, with high integrity impact. All real-world exploitation signals point low: EPSS is 0.17% (6th percentile), the vulnerability is NOT in CISA KEV, no public exploit code is identified, and the CISA SSVC decision framework rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. These signals are consistent with each other - low EPSS, no KEV, and SSVC 'none' all agree this is not under active or imminent mass exploitation. The key caveat is the required precondition: an attacker must already be an authenticated Devolutions Server user who has been granted the global-vault view permission (PR:L), so this is primarily an insider/privilege-boundary risk rather than an anonymous-internet threat. One minor tension worth noting: the official CVSS sets C:L, but the described impact is modification and deletion (an integrity/availability concern) by a user who already holds view rights - so the confidentiality sub-score is debatable and the true weight of this issue is on integrity of global contact/folder data.

A low-privileged employee or contractor who has been granted only 'view' access to the global vault in a Devolutions Server instance (2026.3.7.0 or earlier) leverages the missing authorization check to alter or delete shared global contact and folder entries they should only be able to read. No public exploit code exists, and exploitation requires a valid authenticated session, so the realistic actor is a malicious or compromised internal account rather than an anonymous remote attacker.