What is the CVSS score of CVE-2026-3638?

CVE-2026-3638 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Devolutions Server are affected by CVE-2026-3638?

CVE-2026-3638 presents moderate security risk, a missing authorization vulnerability rated CVSS 5.9. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-3638?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Devolutions Server CVE-2026-3638

MEDIUM

Missing Authorization (CWE-862)

2026-03-09 security@devolutions.net

Authentication Bypass Devolutions Server

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:56 vuln.today

CVE Published

Mar 09, 2026 - 19:16 nvd

MEDIUM 5.9

DescriptionCVE.org

Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests.

AnalysisAI

Improper access control in Devolutions Server 2025.3.11.0 and earlier allows authenticated low-privileged users to restore deleted users and roles through crafted API requests, potentially enabling unauthorized account recovery and privilege escalation. Organizations running affected versions are at risk as attackers with basic authentication credentials can manipulate user and role restoration without proper authorization checks. No patch is currently available.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests.