What is the CVSS score of CVE-2026-9223?

CVE-2026-9223 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-9223

EUVD-2026-31455 MEDIUM

Improper Access Control (CWE-284)

2026-05-22 DEVOLUTIONS

GHSA-9mmr-r4fg-jmhx

Hashicorp Authentication Bypass Server

4.3

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

PR:L confirmed by authenticated low-privilege requirement; I:L only since impact is unauthorized vault creation with no confidentiality or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:35 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

May 22, 2026 - 15:21 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request.

AnalysisAI

Missing authorization in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to bypass vault creation controls via a crafted import request. The flaw targets the vault import API endpoint, enabling unauthorized vault provisioning within a Privileged Access Management platform - a sensitive context where vault-level control can have downstream impact on managed credentials. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.03% (8th percentile) reflects minimal current exploitation likelihood.

Technical ContextAI

Devolutions Server is an enterprise Privileged Access Management (PAM) platform that organizes credentials and secrets into logical vaults. The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the vault import feature fails to enforce authorization checks that should restrict vault creation to privileged roles. The CPE string cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:* confirms all tracked versions up to and including 2026.1.16.0 are within scope. The 'Hashicorp' tag in the intelligence data may suggest interoperability with HashiCorp Vault backends or secret stores, though the root vulnerability resides in Devolutions Server's own API authorization layer for the import workflow, not in any upstream dependency.

RemediationAI

Upgrade Devolutions Server to a version beyond 2026.1.16.0 per the vendor security advisory DEVO-2026-0013, available at https://devolutions.net/security/advisories/DEVO-2026-0013/. The exact patched release version is not independently confirmed from the available input data - only the vulnerable version ceiling is stated - so consult the advisory directly for the specific target version. As a compensating control pending upgrade, administrators should audit and reduce the number of low-privileged accounts with access to the vault import endpoint, enforce least-privilege role assignments within Devolutions Server, and enable audit logging for vault creation events to detect unauthorized activity. Network-layer restrictions on access to the Devolutions Server API (e.g., restricting the import endpoint via reverse proxy ACLs to trusted IP ranges) can reduce exposure but may impair legitimate import workflows for distributed teams.