What is the CVSS score of CVE-2026-15637?

CVE-2026-15637 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Server are affected by CVE-2026-15637?

Devolutions Server versions 2026.1.x and 2026.2.x contain a vulnerability allowing any low-privileged user to improperly access SSH private keys and certificate credentials belonging to other users,…. A patch is available.

How to fix or mitigate CVE-2026-15637?

Within 24 hours, identify all Devolutions Server instances running versions 2026.1.x or 2026.2.x and document which users have low-privilege access to the system. Within 7 days, apply the vendor-released patch to all affected instances and validate successful deployment in a test environment before production rollout. Within 30 days, audit access logs for any unauthorized credential access during the exposure window, rotate all SSH private keys and certificates that may have been accessed by low-privileged users, and verify that the platform's credential isolation controls are functioning as designed.

Server CVE-2026-15637

EUVD-2026-44363 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-07-14 DEVOLUTIONS

GHSA-pf62-83x3-9qjv

Authentication Bypass Server

7.5

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (DEVOLUTIONS) · only source for this CVE.

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 15:24 vuln.today

CVSS changed

Jul 15, 2026 - 15:22 NVD

7.5 (HIGH)

Patch available

Jul 14, 2026 - 23:20 EUVD

CVE Published

Jul 14, 2026 - 18:05 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 14, 2026 - 18:05 cve.org

HIGH 7.5

DescriptionCVE.org

Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.

AnalysisAI

Sensitive information disclosure in Devolutions Server 2026.1.x and 2026.2.x lets an authenticated low-privileged user read the private keys of SSH key and certificate PAM credentials belonging to other users. By supplying a credential identifier they should not have access to (an insecure direct object reference), the attacker retrieves secrets the PAM module is supposed to protect. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch is available. Note: the supplied CVSS vector lists PR:N (unauthenticated) while the description explicitly requires an authenticated low-privileged user — treat this as an authenticated IDOR.