What is the CVSS score of CVE-2026-15642?

CVE-2026-15642 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-15642?

Yes, a patch is available for CVE-2026-15642. Update the affected software to the latest version immediately.

Devolutions Server CVE-2026-15642

EUVD-2026-44365 LOW

Information Exposure (CWE-200)

2026-07-14 DEVOLUTIONS

GHSA-wv55-rmpm-fhq6

Hashicorp Microsoft Information Disclosure Server

3.3

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

3.3 LOW

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

vuln.today AI

3.3 LOW

Local file access is the attack vector; PR:N reflects the attacker needing no Devolutions Server privileges, only file access; C:L because a single Azure credential is exposed with no integrity or availability impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 15, 2026 - 15:35 vuln.today

CVSS changed

Jul 15, 2026 - 15:22 NVD

3.3 (LOW)

Patch available

Jul 14, 2026 - 23:20 EUVD

CVE Published

Jul 14, 2026 - 18:09 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.

AnalysisAI

Devolutions Server 2026.1.22.0 and 2026.2.11.0 exposes Azure Key Vault client secrets in cleartext within Recovery Kit response files, defeating an explicit 'exclude sensitive data' option that administrators rely on. Any party who obtains a copy of the generated response file can trivially read the credential without any decryption or tooling. No public exploit code exists and the vulnerability is not in CISA KEV; however, because successful exploitation yields a reusable cloud credential, the downstream blast radius in Azure environments substantially exceeds what the 3.3 CVSS base score suggests. A vendor-released patch is available.

Technical ContextAI

Devolutions Server is an enterprise Privileged Access Management (PAM) platform that centralizes credential and secrets management. Its Recovery Kit feature generates response files intended for disaster recovery scenarios and exposes an option to exclude sensitive data from those exports. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the code path responsible for sanitizing the output file when the exclusion option is selected fails to strip the Azure Key Vault client secret, writing it to disk in cleartext. The Azure Key Vault integration references both Microsoft (Azure) and HashiCorp tagging in the intelligence data, indicating the affected surface spans cloud key management configurations. Affected CPE is cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*, covering all Server builds below 2026.2.12 in the 2026.2.x branch and below 2026.1.23 in the 2026.1.x branch per EUVD-2026-44365.

RemediationAI

Upgrade Devolutions Server to version 2026.1.23 or later (for 2026.1.x deployments) or to version 2026.2.12 or later (for 2026.2.x deployments), as documented in the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0024/. For organizations that cannot patch immediately, restrict filesystem permissions on Recovery Kit response files to only the generating administrator account and ensure the files are not stored in shared network locations or transmitted unencrypted. Critically, any organization that has generated a Recovery Kit response file using an affected version should treat the Azure Key Vault client secret as compromised: rotate the secret in the Azure portal immediately and audit Azure Key Vault access logs for unauthorized API calls. Note that rotating the Azure Key Vault client secret requires updating the Devolutions Server configuration with the new credential before resuming normal operations. Do not regenerate Recovery Kit files on unpatched versions as a workaround - the flaw is in the generation code path itself.