Devolutions Server CVE-2026-9223

Exploitation requires a valid low-privileged authenticated session on the target Devolutions Server instance, confirmed by CVSS PR:L. The attacker must have network access to the Devolutions Server API and the ability to reach the vault import endpoint. The vulnerability is specific to the import code path - standard vault creation through the UI likely enforces proper authorization, making a crafted import request the exclusive exploitation mechanism. No non-default configuration is required beyond having a low-privileged account. Limiting factors: authentication is mandatory (reducing exposure to internal or already-compromised accounts); the SSVC 'not automatable' rating implies the request must be manually crafted rather than script-blasted at scale; and the impact is scoped to vault creation only (I:L), with no direct confidentiality or availability compromise from the flaw itself.

The CVSS 4.3 Medium score is internally consistent with the attack profile: network-reachable (AV:N), low complexity (AC:L), low-privilege authentication required (PR:L), no user interaction (UI:N), and limited integrity impact only (I:L) with no confidentiality or availability impact. EPSS at 0.03% (8th percentile) and SSVC exploitation status of 'none' align to indicate this vulnerability is not currently being exploited opportunistically or at scale. The SSVC 'not automatable' rating suggests manual request crafting is required, further suppressing mass-exploitation risk. The absence from CISA KEV confirms no confirmed active exploitation at time of analysis. The realistic risk is bounded by the PR:L requirement - an attacker must already possess a valid low-privileged account within the Devolutions Server environment, limiting the exposed surface to internal users or compromised accounts. However, in a PAM context, unauthorized vault creation is a meaningful integrity violation that could facilitate lateral movement or credential exfiltration if paired with other privileges.

An authenticated low-privileged user with a valid Devolutions Server session crafts a malicious HTTP import request targeting the vault import API endpoint, bypassing the missing authorization check to create a new vault that the user's role should not permit. Once an unauthorized vault exists under attacker control, it could be used to stage or redirect credential storage within the PAM platform, potentially enabling further privilege escalation if vault-level permissions are subsequently misconfigured. No public exploit code has been identified at time of analysis.