What is the CVSS score of CVE-2026-9247?

CVE-2026-9247 has a CVSS 3.1 base score of 2.4 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-9247

EUVD-2026-31453 LOW

Insufficient Logging (CWE-778)

2026-05-22 DEVOLUTIONS

GHSA-3g3q-8qfh-j8w8

Information Disclosure Server

2.4

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

2.4 LOW

AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

vuln.today AI

2.4 LOW

High privileges required for export access; integrity impact scoped to audit log bypass only; no confidentiality loss since the attacker already held export rights.

3.1 AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:36 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

2.4 (None) 2.4 (LOW)

CVE Published

May 22, 2026 - 15:23 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request.

This issue affects :

Devolutions Server 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier

AnalysisAI

Devolutions Server's entry export feature silently bypasses the unseal notification workflow when an authenticated, export-privileged user submits a crafted export request against a sealed entry. Sealed entries in Devolutions Server carry an explicit administrative oversight guarantee - unseal events trigger notifications to administrators - making this a control bypass against a core PAM audit promise rather than a direct credential theft. Affected versions span 2025.3.20.0 and earlier as well as 2026.1.6.0 through 2026.1.16.0; no public exploit exists and EPSS sits at 0.03% (8th percentile), reflecting no observed attacker interest at time of analysis.

Technical ContextAI

Devolutions Server is a Privileged Access Management (PAM) and enterprise password vault solution. 'Sealed entries' are a product-specific protection mechanism: credential entries flagged as sealed require explicit authorization to access, and the act of unsealing is supposed to generate audit log entries and administrator notifications as an oversight control. The root cause is CWE-778 (Insufficient Logging) - the export API endpoint fails to emit the unseal notification event when the export request is crafted in a specific way, decoupling the data retrieval from the audit pipeline. The affected CPE is cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*, covering all platform variants of the server product across the stated version ranges.

RemediationAI

Upgrade Devolutions Server to a version beyond 2026.1.16.0 per the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0013/; the exact patched release version is not independently confirmed from available data and should be verified directly with the vendor. As an interim compensating control, administrators should audit existing export activity logs for sealed entries to identify any prior silent exports, and reduce export permissions to the minimum set of accounts that genuinely require them - restricting who can export sealed entries directly limits the pool of accounts that could exploit this bypass. Note that restricting export permissions may impact legitimate operational workflows and should be reviewed with stakeholders before implementation.