What is the CVSS score of CVE-2026-15641?

CVE-2026-15641 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of Server are affected by CVE-2026-15641?

Devolutions Server versions 2026.2.11 and 2026.1.22 contain an authorization bypass vulnerability that allows authenticated low-privilege users to self-approve access requests, granting themselves…. A patch is available.

How to fix or mitigate CVE-2026-15641?

Within 24 hours, inventory all Devolutions Server deployments to identify instances running versions 2026.2.11 or 2026.1.22; assess business risk based on sensitivity of resources protected by access requests on each system. Within 7 days, apply the vendor-provided patch to all affected systems and verify successful remediation through version checks and access request workflow validation. Within 30 days, conduct a full audit of access requests approved during the past 60 days to identify any unauthorized escalations, implement enhanced logging and alerting on access request approvals, and document your remediation timeline in your security incident register.

Server CVE-2026-15641

EUVD-2026-44364 HIGH

Incorrect Authorization (CWE-863)

2026-07-14 DEVOLUTIONS

GHSA-9pqv-fcx6-hhjc

Authentication Bypass Server

7.1

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Primary rating from Vendor (DEVOLUTIONS) · only source for this CVE.

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 15:25 vuln.today

CVSS changed

Jul 15, 2026 - 15:22 NVD

7.1 (HIGH)

Patch available

Jul 14, 2026 - 23:20 EUVD

CVE Published

Jul 14, 2026 - 18:09 cve.org

UNKNOWN (no severity yet)

CVE Published

Jul 14, 2026 - 18:09 cve.org

HIGH 7.1

DescriptionCVE.org

Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review.

AnalysisAI

Authorization bypass in Devolutions Server 2026.2.11 and 2026.1.22 lets an authenticated low-privileged user approve their own pending access request by calling the access request status endpoint directly, bypassing the mandatory approver review. Because access requests gate elevated access to protected resources, this effectively grants unauthorized privileged access (CVSS 7.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the issue was disclosed and patched by the vendor.