What is the CVSS score of CVE-2026-10786?

CVE-2026-10786 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-10786

EUVD-2026-35182 MEDIUM

Cleartext Storage of Sensitive Information (CWE-312)

2026-06-08 DEVOLUTIONS

Information Disclosure Server

6.5

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (DEVOLUTIONS) · only source for this CVE.

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 21:23 vuln.today

CVSS changed

Jun 08, 2026 - 21:22 NVD

6.5 (MEDIUM)

CVE Published

Jun 08, 2026 - 18:26 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request.

This issue affects :

Devolutions Server 2026.2.4.0
Devolutions Server 2026.1.20.0 and earlier

AnalysisAI

Cleartext credential exposure in Devolutions Server allows an authenticated low-privileged user to retrieve plaintext credentials stored for configured ticketing integrations via a crafted API request. Affected versions include Devolutions Server 2026.2.4.0 and all 2026.1.x releases up to and including 2026.1.20.0. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-disclosed by Devolutions via advisory DEVO-2026-0015.

Technical ContextAI

The vulnerability is rooted in CWE-312 (Cleartext Storage of Sensitive Information) within the ticketing integration configuration subsystem of Devolutions Server, a privileged access management and remote connection platform. The affected CPE is cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*, covering the server application. The core issue is that the API endpoint responsible for returning ticketing integration settings - which includes third-party service credentials such as API keys or account passwords - does not enforce proper access controls, allowing any authenticated user, regardless of privilege level, to retrieve those credentials in cleartext. This indicates that credentials are either stored without encryption or decrypted server-side and returned in API responses without adequate authorization checks on the caller's role.

RemediationAI

Consult and apply the guidance in vendor advisory DEVO-2026-0015 at https://devolutions.net/security/advisories/DEVO-2026-0015/ to obtain the patched release. A specific fixed version number was not included in the available data, so do not infer a safe version without consulting the advisory directly - patch status is confirmed per vendor disclosure but the exact target upgrade version must be verified there. As an interim compensating control, administrators should audit and rotate all credentials stored within ticketing integration configurations, as any low-privileged account may have accessed them prior to patching. Additionally, restrict Devolutions Server access to the minimum set of authenticated users required, and review API access logs for anomalous requests to ticketing integration settings endpoints. Disabling ticketing integrations entirely until patched eliminates the exposed attack surface at the cost of workflow disruption.