Devolutions Server CVE-2026-9251

Exploitation requires a valid authenticated session as a non-administrator Devolutions Server user (CVSS PR:L confirmed). The specific condition enabling the attack is the presence of vault entries protected by the administrator-enforced Pending Approval workflow - environments not using this feature are not exposed. The attack targets the entry status management API endpoint and requires crafting a manipulated status change request, meaning the attacker must have some familiarity with the Devolutions Server API structure. SSVC confirms the attack is not automatable, ruling out mass opportunistic exploitation. Limiting factors include: authentication at low-privilege level is mandatory (unauthenticated external attackers cannot exploit this), only entries subject to the Pending Approval flow are at risk, and only the affected version ranges (2025.3.20.0 and earlier; 2026.1.6.0 through 2026.1.16.0) are vulnerable.

The CVSS 5.4 Medium score is consistent with the attack profile: network-accessible (AV:N), low complexity (AC:L), requiring only a low-privilege authenticated session (PR:L), no user interaction (UI:N), unchanged scope (S:U), and limited confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N). EPSS at 0.03% (7th percentile) reflects very low real-world exploitation probability. SSVC reinforces low urgency: exploitation status is none, the attack is not automatable - indicating it requires deliberate, targeted request crafting rather than mass scanning - and technical impact is only partial. No CISA KEV listing exists and no POC has been identified. The realistic threat is an insider or low-privilege user deliberately abusing the workflow gap in a shared Devolutions Server deployment where the Pending Approval flow is actively relied upon for access control separation. Organizations not using the Pending Approval workflow feature face no practical exposure from this flaw.

An authenticated Devolutions Server user with a standard non-administrator account identifies a vault entry protected by an administrator-enforced Pending Approval flow. The user crafts a direct HTTP request to the entry status management API, substituting a status value that marks the entry as approved or accessible without triggering the expected administrative authorization check. The server processes the unenforced request and returns the protected entry's data, bypassing the approval gate entirely. No public exploit code exists, so exploitation requires knowledge of the API structure and deliberate targeting.