What is the CVSS score of CVE-2026-7325?

CVE-2026-7325 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Devolutions Server are affected by CVE-2026-7325?

Devolutions Server (versions 2026.1.6.0-2026.1.16.0 and 2025.3.20.0 and earlier) contains a credential disclosure vulnerability allowing unauthorized exfiltration of privileged service-account…

How to fix or mitigate CVE-2026-7325?

Within 24 hours, identify and document all Devolutions Server instances running versions 2026.1.6.0 through 2026.1.16.0 or 2025.3.20.0 and earlier, and review access logs for suspicious credential relay activity targeting downstream systems. Within 7 days, implement network-level restrictions to prevent Devolutions Server from connecting to unauthorized hosts, disable or restrict Active Directory browsing features in affected versions, and audit all managed service-account credentials for unauthorized access or use. Within 30 days, establish formal monitoring of Devolutions vendor advisories for patches, conduct a privilege-access review to identify over-provisioned service accounts, and implement mandatory network segmentation for all service-account authentication flows.

Devolutions Server CVE-2026-7325

EUVD-2026-31462 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-22 DEVOLUTIONS

GHSA-8hf9-2h6f-g638

SSRF Server Devolutions

7.1

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

7.1 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-reachable but needs low-priv auth (PR:L) and a non-trivial relay setup (AC:H); leaked privileged credential crosses security scope (S:C, C:H) with no integrity/availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:31 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

7.1 (None) 7.1 (HIGH)

CVE Published

May 22, 2026 - 15:30 nvd

UNKNOWN (no severity yet)

CVE Published

May 22, 2026 - 15:30 cve.org

HIGH 7.1

DescriptionCVE.org

Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with a stored PAM provider service account via authentication relay to an attacker-controlled server.

This issue affects :

Devolutions Server 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier

AnalysisAI

Credential disclosure in Devolutions Server (2026.1.6.0-2026.1.16.0 and 2025.3.20.0 and earlier) lets a low-privileged authenticated user coerce the server's Active Directory browsing feature into authenticating against an attacker-controlled host, relaying the stored PAM provider service-account credentials. Classified as SSRF (CWE-918), it enables theft of privileged service-account authentication material that can then be abused against downstream systems. No public exploit identified at time of analysis; EPSS is very low (0.04%, 11th percentile) and CISA SSVC rates exploitation as none.

Technical ContextAI

Devolutions Server is a self-hosted privileged access management (PAM) and credential/remote-connection platform used to broker and vault privileged accounts. The flaw sits in the Active Directory browsing feature, which performs outbound authentication to a directory endpoint on the user's behalf. Because the target endpoint is not properly authorized/validated, a user can point it at an attacker-controlled server and capture the relayed authentication handshake - a classic Server-Side Request Forgery (CWE-918) pattern where the trusted server is tricked into initiating a request/authentication to an attacker-chosen destination. The material exposed is the stored PAM provider service account's credentials, which are typically high-value because that account is used to manage other privileged accounts. The CPE cpe:2.3:a:devolutions:server covers all affected builds.

RemediationAI

Patch available per vendor advisory (DEVO-2026-0013, https://devolutions.net/security/advisories/DEVO-2026-0013/): upgrade to a fixed build above the affected ranges - a release later than 2026.1.16.0 on the 2026.1 branch, or later than 2025.3.20.0 on the 2025.3 branch (confirm the exact patched version directly in the advisory, as the input does not state a specific fix build). As compensating controls until patched, restrict or disable use of the Active Directory browsing feature for low-privileged roles, and tighten which accounts may configure or trigger AD browsing; apply egress network filtering so the Devolutions Server cannot initiate outbound authentication to arbitrary/attacker-controlled hosts (restrict directory traffic to known internal domain controllers) - note this may break legitimate AD lookups to unlisted domains. Additionally, rotate the PAM provider service-account credentials after patching in case they were already exposed, and monitor for unexpected outbound authentication attempts from the server.