What is the CVSS score of CVE-2026-9249?

CVE-2026-9249 has a CVSS 3.1 base score of 3.1 (Low). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-9249

EUVD-2026-31457 LOW

Unverified Password Change (CWE-620)

2026-05-22 DEVOLUTIONS

GHSA-7m8m-72m7-5vcc

Information Disclosure Server Devolutions

3.1

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

3.1 LOW

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Successful exploitation enables account takeover on a PAM platform, warranting I:H over the vendor's I:L; AV:N, AC:H, and PR:L match the description and CVSS vector directly.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:38 vuln.today

CVSS changed

Jul 23, 2026 - 16:22 NVD

3.1 (None) 3.1 (LOW)

CVE Published

May 22, 2026 - 15:24 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request.

This issue affects :

Devolutions Server 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier

AnalysisAI

Unverified password change in Devolutions Server allows a low-privileged authenticated attacker to reset any user's account password by submitting a crafted request that omits or bypasses the current-password verification step. Affected are all releases up to and including 2025.3.20.0 and a specific 2026.1.x branch window (2026.1.6.0 through 2026.1.16.0), meaning the flaw spans both legacy and recent deployments of this enterprise PAM platform. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile) and SSVC exploitation status is confirmed as none, but the sensitivity of a PAM system as the target elevates real-world risk beyond the raw CVSS 3.1 score of 3.1.

Technical ContextAI

Devolutions Server is an enterprise Privileged Access Management (PAM) and password vault platform (CPE: cpe:2.3:a:devolutions:server). CWE-620 (Unverified Password Change) describes a failure to require the user's existing credential before accepting a new password on a change request - a foundational identity-integrity control. In this case, the vulnerable password-change API endpoint accepts crafted HTTP requests where the old-password field is absent or bypassed, and the server processes the change without challenge. The dual version ranges - all releases through 2025.3.20.0 and the narrower 2026.1.6.0-2026.1.16.0 window - suggest the flaw existed historically, was addressed in early 2026.1.x releases (2026.1.1.0-2026.1.5.0 appear unaffected), and was then reintroduced or not carried forward in 2026.1.6.0, before being resolved again after 2026.1.16.0.

RemediationAI

Organizations should consult the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0013/ to confirm the exact patched release and upgrade Devolutions Server to a version newer than 2026.1.16.0 in the 2026.1.x branch, or to the next patched release in the 2025.3.x line. The exact fixed version is not independently confirmed from available data and must be verified from the advisory directly - do not infer a specific version number. Because Devolutions self-reported this vulnerability, a patch was likely available or imminent at disclosure time. As a compensating control while patching is arranged, restrict access to the Devolutions Server web interface and API to trusted internal network segments, reducing exposure of the password-change endpoint to the broader attacker surface. Enable and monitor audit logs for password-change events to detect anomalous activity; this adds detection capability with no service disruption. Note that network segmentation does not eliminate insider-threat risk and should not be treated as a long-term substitute for patching.