Skip to main content

Devolutions Server CVE-2026-17570

| EUVDEUVD-2026-49380 MEDIUM
Authorization Bypass Through User-Controlled Key (CWE-639)
2026-07-27 security@devolutions.net GHSA-6w8j-g3mg-6qw4
Authentication Bypass Devolutions Server
4.3
CVSS 3.1 · Vendor: devolutions
Share

Severity by source

Vendor (devolutions) PRIMARY
4.3 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from Vendor (devolutions) · only source for this CVE.

CVSS VectorVendor: devolutions

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

4
Analysis Generated
Jul 27, 2026 - 20:35 vuln.today
CVSS changed
Jul 27, 2026 - 19:22 NVD
4.3 (MEDIUM)
Patch available
Jul 27, 2026 - 19:02 EUVD
CVE Published
Jul 27, 2026 - 18:16 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.

This issue affects :

  • Devolutions Server 2026.2.4.0 through 2026.2.12.0
  • Devolutions Server 2026.1.23.0 and earlier

AnalysisAI

Disclosure of plaintext credential secrets in Devolutions Server allows authenticated low-privileged users to access PAM password history entries via crafted API requests. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier, with vendor patches released (DEVO-2026-0026). No active exploitation or public exploit code has been identified at time of analysis.

More in Devolutions Server

View all
CVE-2026-3204 CRITICAL
9.8 Mar 03

Input validation flaw in Devolutions Server error message page enables remote spoofing attacks.
CVE-2026-3224 CRITICAL
9.8 Mar 03

Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
CVE-2026-0610 CRITICAL
9.8 Jan 19

Devolutions Server 2025.3.1 through 2025.3.6 contains a SQL injection vulnerability in the remote sessions component tha
CVE-2026-3130 CRITICAL
9.8 Mar 03

Behavioral control bypass in Devolutions Server 2025.3.15 allows authenticated users to exploit delete permissions.
CVE-2024-2921 CRITICAL
9.8 Mar 26

Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated u
CVE-2021-23921 CRITICAL
9.1 Apr 01

An issue was discovered in Devolutions Server before 2020.3. Rated critical severity (CVSS 9.1), this vulnerability is r
CVE-2026-17568 HIGH
8.8 Jul 27

Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group member
CVE-2025-13757 HIGH
8.8 Nov 27

SQL Injection vulnerability in last usage logs in Devolutions Server.2.20, through 2025.3.8. Rated high severity (CVSS 8
CVE-2024-2915 HIGH
8.8 Mar 26

Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access t
CVE-2023-0953 HIGH
8.8 Mar 01

Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authe
CVE-2023-0951 HIGH
8.8 Mar 01

Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privil
CVE-2022-33996 HIGH
8.8 Jul 07

Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inh

Same weakness CWE-639 – Authorization Bypass Through User-Controlled Key

View all
CVE-2024-50483 CRITICAL
9.8
CVE-2026-55255 HIGH POC
8.4
CVE-2025-3605 CRITICAL POC
9.8
CVE-2022-3805 HIGH POC
8.6
CVE-2025-5947 CRITICAL POC
9.8
CVE-2020-36923 CRITICAL POC
9.8
CVE-2025-14998 CRITICAL POC
9.8
CVE-2023-3048 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-17570 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy