Devolutions Server CVE-2026-9247

Exploitation requires an authenticated Devolutions Server account with export permissions - the CVSS vector confirms PR:H (high privileges required). UI:R in the CVSS vector indicates some form of user interaction is involved in the exploit path. The bypass only applies to the entry export feature and specifically to sealed entries; if no sealed entries exist in the environment, the vulnerability has no exploitable effect. Critically, this vulnerability does not grant access beyond what the attacker's account is already authorized for - it only suppresses the notification that administrators would otherwise receive. Limiting factors: (1) high-privilege authenticated access is mandatory, (2) the export request must be deliberately crafted rather than incidentally triggered, (3) impact is confined to audit integrity loss rather than any direct confidentiality or availability breach.

The CVSS 2.4 score (AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) accurately reflects limited technical severity: no confidentiality impact in CVSS terms because the attacker already holds export permissions, no availability impact, and integrity impact is scoped to the audit record rather than data corruption. SSVC corroborates this - Exploitation: none, Automatable: no, Technical Impact: partial. EPSS at 0.03% (8th percentile) shows negligible exploitation interest. However, CVSS systematically underrepresents audit-bypass flaws in PAM products: organizations deploying Devolutions Server specifically rely on the sealed entry notification as a compensating control over privileged credential access. An insider or compromised high-privilege account that silently exports sealed entries defeats the core accountability promise of the product. Real-world priority should be elevated for environments where sealed entry controls are treated as a security boundary, despite the low numerical score.

An insider or compromised Devolutions Server account holding export permissions identifies a sealed entry containing sensitive credentials. The attacker submits a crafted export request that satisfies the export authorization check but bypasses the unseal notification logic, retrieving the sealed credential data without triggering any administrator alert. The credential is then available for lateral movement or exfiltration while administrators remain unaware the sealed entry was ever accessed.