Devolutions Server CVE-2026-6706

Exploitation requires a valid authenticated account on the Devolutions Server instance (PR:L per CVSS vector), meaning the attacker must have at minimum a low-privilege user credential. The vault documentation feature must be in use - vaults with no attached documentation yield no useful data. The attacker must be able to reference valid vault identifiers for the target vaults, which may require prior reconnaissance or enumeration within the platform. Limiting factors: unauthenticated exploitation is not possible; the attacker must already hold a legitimate account; SSVC Automatable=no indicates mass automated exploitation is not straightforward, likely because vault IDs must be known or guessed. Only the confidentiality of vault documentation is at risk - no write access or service disruption is possible via this flaw.

The CVSS base score of 6.5 (Medium) is driven by a network attack vector, low complexity, and low privilege requirement (authenticated), with a high confidentiality impact and no integrity or availability impact (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). However, real-world risk signals sharply discount the urgency: EPSS is 0.03% at the 8th percentile, indicating statistically very low exploitation likelihood relative to all known vulnerabilities. SSVC corroborates this with exploitation=none, automatable=no, and technical impact=partial. There is no CISA KEV listing and no public exploit code identified. The 'Automatable: no' SSVC assessment is notable - despite AV:N/AC:L, the non-trivial vault-scoped crafted API request likely requires knowledge of internal vault identifiers, preventing fully automated mass exploitation. The primary real-world concern is insider threat or a compromised low-privilege account being used to enumerate documentation from vaults the attacker should not access, particularly if those vaults contain secrets metadata, credentials, or operational notes.

An attacker with a valid but low-privileged Devolutions Server account - such as a contractor or junior employee with access to only one vault - crafts an API request referencing the documentation endpoint of a vault they are not authorized to access. By manipulating vault identifiers in the request, they bypass the missing server-side authorization check and retrieve documentation content from sensitive vaults. No public proof-of-concept code is known to exist, but the attack requires only basic HTTP manipulation skills.