Devolutions Server CVE-2026-9522

Requires a valid authenticated session on Devolutions Server with at least low-privilege access (CVSS PR:L confirmed). The PAM account discovery feature must be in use and at least one network discovery scan configuration must exist as a deletion target. Exploitation is limited to users who can authenticate to the Devolutions Server instance - unauthenticated external attackers cannot exploit this directly. The vulnerability does not require administrative credentials, non-default configuration, or specific platform conditions beyond having an active Devolutions Server deployment running version 2026.1.19 or earlier with the PAM module enabled.

The CVSS 5.4 Medium score reflects a constrained impact: confidentiality and integrity are each rated Low (C:L/I:L), availability is unaffected (A:N), and scope is unchanged. Attack vector is Network with Low complexity and Low privilege required, meaning any valid account can trigger this from across the network without interaction. The real-world risk is lower than a typical network-exploitable flaw because the attacker must already be authenticated, limiting the population of potential abusers to internal users or compromised accounts. No EPSS score was provided, no KEV listing exists, and no POC has been identified, all suggesting this has not attracted opportunistic exploitation. The 'Authentication Bypass' tag in the source data is misleading - the CVSS PR:L vector confirms authentication is required; this is more accurately broken authorization or privilege escalation within an authenticated session. The primary business risk is disruption to PAM discovery infrastructure: deleting scan configurations could blind security teams to unmanaged privileged accounts on the network.

An authenticated low-privilege Devolutions Server user - such as a help desk operator or read-only auditor - sends a crafted delete request to the PAM account discovery API targeting an existing scan configuration. Because the server does not verify admin-level authorization for this operation, the configuration is silently removed, potentially disrupting scheduled discovery scans and reducing visibility into unmanaged privileged accounts. No public exploit code has been identified, but the low complexity and network accessibility make this trivially reproducible by any authenticated user.