What is the CVSS score of CVE-2026-9246?

CVE-2026-9246 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-9246

EUVD-2026-31458 MEDIUM

Missing Authorization (CWE-862)

2026-05-22 DEVOLUTIONS

GHSA-66j7-xv33-vfjx

Hashicorp Authentication Bypass Server

4.3

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-accessible API with low-privilege auth required; impact is confidentiality-only (data read), not integrity - correcting the vendor's apparent C:N/I:L inversion.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:37 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

4.3 (None) 4.3 (MEDIUM)

CVE Published

May 22, 2026 - 15:26 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request.

This issue affects :

Devolutions Server 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier

AnalysisAI

Improper access control in Devolutions Server exposes documentation and attachments of sealed vault entries to any authenticated user who holds vault read access. Sealed entries are an explicit security boundary intended to restrict access beyond standard vault permissions - this bypass undermines that control entirely via a crafted API request. No public exploit has been identified and SSVC indicates no known exploitation, but the attack requires only low-privilege authentication, making it accessible to any insider or compromised credential with vault read rights.

Technical ContextAI

Devolutions Server (CPE: cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*) is an enterprise Privileged Access Management (PAM) platform. Vault entries can be 'sealed', a designation that imposes additional access control beyond standard vault-level permissions. The root cause is CWE-862 (Missing Authorization): the server-side API endpoints serving entry documentation and attachments fail to enforce the sealed-entry authorization check, allowing the sealed status to be bypassed. The 'Hashicorp' tag suggests possible integration with HashiCorp Vault infrastructure, though the vulnerability itself resides in Devolutions Server's own API layer, not in HashiCorp components.

RemediationAI

The vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0013/ should be consulted for the confirmed fixed version; based on the affected range (up to 2026.1.16.0), upgrading to Devolutions Server 2026.1.17.0 or later is the indicated remediation, though the exact fix version must be confirmed directly from DEVO-2026-0013 as it was not explicitly stated in available data. As a compensating control prior to patching, administrators should audit which accounts hold vault read access and apply the principle of least privilege - users who do not require access to sensitive vault entries should have their vault permissions revoked or scoped. Additionally, reviewing audit logs for anomalous API requests targeting sealed entry documentation endpoints can help detect prior exploitation. Sealed entries containing the most sensitive credentials should be temporarily migrated to a separate vault with tighter access controls until the patch is applied.