Devolutions Server CVE-2026-9226

Exploitation requires that Devolutions Server (2026.3.7.0 or earlier) be configured to use the Azure AD external login flow - a deployment-specific authentication integration. The attacker must then occupy an adjacent network position (AV:A) to intercept the login-session token exposed in the OAuth/redirect URL and must replay it before it expires. Limiting factors that reduce real-world risk: the adjacent-network requirement rules out direct Internet-based attack, the high attack complexity (AC:H) reflects the need to capture a live valid token during a legitimate user login, and installations not using Azure AD external login are not affected. No victim interaction with the attacker is required (UI:N), but the attack depends on observing a genuine user authentication event.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS 3.1 base score of 6.8 (Medium) is driven down from its total technical impact (C:H/I:H) by two significant limiting metrics: AV:A (adjacent network, not fully remote/Internet-wide) and AC:H (high attack complexity). All exploitation signals point the same direction and are mutually consistent: EPSS is very low at 0.22% (11th percentile), the SSVC decision framework reports Exploitation=none and Automatable=no (while confirming Technical Impact=total), and there is no CISA KEV listing and no public exploit identified. The convergence of low EPSS, non-automatable SSVC, and no KEV indicates this is a hard-to-mass-exploit, opportunistic-only flaw rather than a widely weaponized one - the attacker must first intercept a valid session token on an adjacent network segment. The 'total' technical impact (full account takeover) is the one signal arguing for prioritization, so this warrants prompt patching for organizations using the Azure AD external login flow, but it does not justify emergency out-of-band response. Note one nuance to verify: the description frames this as a 'remote attacker,' yet the CVSS vector is AV:A (adjacent), implying the attacker needs a privileged network position to capture the token - the two are reconcilable but defenders should confirm their network exposure.

An attacker positioned on the same adjacent network segment as a target user (e.g., shared corporate LAN or compromised network device) intercepts the Devolutions Server Azure AD external login flow and captures the login-session token that is exposed in a redirect URL. The attacker then replays that captured token to authenticate as the victim and take over their account. No public exploit code has been identified, and the high attack complexity (AC:H) reflects the need to capture a valid, unexpired token in transit.