Devolutions Server CVE-2026-15642

Exploitation requires three concurrent conditions: (1) Devolutions Server must be running an affected version (below 2026.1.23 in the 2026.1.x branch or below 2026.2.12 in the 2026.2.x branch) with an Azure Key Vault client secret configured in its integration settings; (2) a legitimate user (UI:R per CVSS) must have initiated Recovery Kit response file generation - the vulnerability is triggered at generation time, not at runtime; (3) the attacker must obtain read access to the generated response file, whether through insider access, a compromised host with file share access, insecure backup storage, or accidental distribution. The 'exclude sensitive data' option being selected is explicitly stated as insufficient to prevent exposure - this is notable because administrators who believe they opted out of sensitive data inclusion are the most likely to mishandle the output file. Exploitation is bounded by file access: it cannot be triggered remotely over the network and does not affect Devolutions Server instances that have not configured the Azure Key Vault integration.

The CVSS 3.3 (Low) base score reflects a local attack vector (AV:L), no privileges required on the Devolutions Server itself (PR:N), and mandatory user interaction (UI:R) - all of which constrain exploitability. EPSS data was not included in the provided intelligence, so exploitation probability cannot be quantified from that signal. The vulnerability is not in CISA KEV and no public exploit code has been identified, placing this firmly in the 'no public exploit identified at time of analysis' category. The CVSS PR:N metric warrants careful interpretation: an attacker needs no Devolutions Server privileges, but does require physical or logical access to the generated response file - a non-trivial prerequisite that is not captured by the raw vector. The critical risk amplifier here is credential exposure: a single extracted Azure Key Vault client secret can unlock access to all secrets stored in the associated vault, making the downstream confidentiality and integrity impact on Azure infrastructure disproportionately high relative to the base score. Real-world prioritization should be elevated for any organization using Devolutions Server's Azure Key Vault integration, particularly if response files are stored in shared directories, transmitted over email, or backed up without encryption.

An administrator on an affected Devolutions Server instance generates a Recovery Kit response file and, trusting the 'exclude sensitive data' option, stores it in a shared internal network location for disaster recovery purposes. An insider threat or an attacker who has compromised a low-privileged workstation with access to that share opens the file in a text editor and reads the Azure Key Vault client secret in cleartext. The attacker then authenticates directly to Azure Key Vault using the extracted secret and exfiltrates all secrets stored within the vault. No public exploit code has been identified; the attack requires only file read access and no specialized tooling.