What is the CVSS score of CVE-2026-9522?

CVE-2026-9522 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-9522

EUVD-2026-33937 MEDIUM

Improper Access Control (CWE-284)

2026-06-02 DEVOLUTIONS

GHSA-7x7j-8c59-q4gr

Authentication Bypass Server

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 20:31 vuln.today

CVSS changed

Jun 02, 2026 - 20:22 NVD

5.4 (MEDIUM)

CVE Published

Jun 02, 2026 - 14:08 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.

AnalysisAI

Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated low-privilege user to delete PAM network discovery scan configurations that should be restricted to administrators. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only a valid low-privilege account over the network with no user interaction. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Technical ContextAI

Devolutions Server is a Privileged Access Management (PAM) platform; the affected component is its account discovery feature, which scans networks to identify and onboard privileged accounts. CWE-284 (Improper Access Control) indicates the server fails to enforce role separation on destructive operations - specifically, the API endpoint or UI handler for deleting discovery scan configurations does not validate that the requesting user holds administrative privileges before executing the operation. The CPE string cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:* confirms all version instances of the server product are in scope up to and including 2026.1.19.

RemediationAI

Consult the Devolutions security advisory DEVO-2026-0014 at https://devolutions.net/security/advisories/DEVO-2026-0014/ for the confirmed fixed release version and upgrade guidance; the exact patched version is not independently confirmed from the data available at time of analysis beyond the implication that versions after 2026.1.19 contain the fix. As a compensating control, restrict Devolutions Server PAM account discovery access to the minimum set of users who require it, and audit existing user role assignments to remove discovery-related permissions from non-administrative accounts. Monitoring deletion events in PAM discovery scan configurations via Devolutions Server's audit logs can serve as a detective control until the patch is applied. Note that restricting user access may impact discovery workflows if low-privilege accounts are legitimately assigned to run scans.