What is the CVSS score of CVE-2026-9224?

CVE-2026-9224 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-9224

EUVD-2026-31456 MEDIUM

Missing Authorization (CWE-862)

2026-05-22 DEVOLUTIONS

GHSA-9q8w-9j39-h44q

Authentication Bypass Server Devolutions

4.3

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible API requires authenticated AD session (PR:L); impact is limited to integrity of profile attributes with no confidentiality or availability loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:37 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

May 22, 2026 - 15:25 cve.org

MEDIUM 4.3

CVE Published

May 22, 2026 - 15:25 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted API request.

This issue affects :

Devolutions Server 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier

AnalysisAI

Missing authorization on the profile update API in Devolutions Server allows any authenticated Active Directory user to modify their own profile attributes beyond their permitted scope via a crafted API request. Affected are versions 2025.3.20.0 and earlier and 2026.1.6.0 through 2026.1.16.0. No public exploit has been identified and EPSS sits at 0.03% (8th percentile), but any AD-authenticated user with network reach to the API can tamper with profile data without additional privilege.

Technical ContextAI

Devolutions Server is an enterprise privileged access management (PAM) and password vault platform that integrates with Active Directory for identity and authentication services. The vulnerability resides in the server-side API handler for user profile updates, which is exposed over the network and consumed by AD-authenticated sessions. CWE-862 (Missing Authorization) identifies the root cause: the endpoint authenticates the caller but does not enforce attribute-level or role-level authorization checks to restrict which profile fields a given user may modify. The CPE cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:* scopes the flaw to the server application component specifically, not client-side tooling.

RemediationAI

Upgrade Devolutions Server to a version beyond 2026.1.16.0 in the 2026.1.x train or beyond 2025.3.20.0 in the 2025.3.x train per vendor advisory DEVO-2026-0013 at https://devolutions.net/security/advisories/DEVO-2026-0013/. The exact patched release number is not specified in available data - consult the advisory directly to identify the minimum safe version before upgrading. As a compensating control pending patch deployment, restrict network access to the Devolutions Server API endpoint to trusted hosts or VPN segments only, which limits the attacker pool to users with both valid AD credentials and approved network paths; note this may impair legitimate remote self-service profile workflows. Additionally, enable audit logging on profile update API calls and alert on attribute changes outside expected patterns to detect exploitation attempts.