What is the CVSS score of CVE-2026-9590?

CVE-2026-9590 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Devolutions Server CVE-2026-9590

EUVD-2026-33935 MEDIUM

Improper Access Control (CWE-284)

2026-06-02 DEVOLUTIONS

GHSA-3xh5-wf4g-97h5

Authentication Bypass Server

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 20:31 vuln.today

CVSS changed

Jun 02, 2026 - 20:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 02, 2026 - 14:07 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission.

AnalysisAI

Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated user holding entry edit privileges to modify asset information beyond their authorized scope, bypassing the permission validation layer. The flaw resides in the permission validation component and enables privilege overreach within the platform's access control model - an authenticated low-privilege user can alter data they should have no write access to. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Technical ContextAI

Devolutions Server is a privileged access management (PAM) and credential vault platform. The vulnerability is classified under CWE-284 (Improper Access Control), indicating that the permission validation component fails to enforce the full set of required permissions before allowing a write operation on asset information. The flaw lies in the separation between 'entry edit' privileges and the distinct 'asset modification' permission - the system incorrectly conflates or short-circuits these checks, allowing a user with the former to perform actions gated behind the latter. Affected product is identified via CPE cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*, covering all versions up to and including 2026.1.19. The tag 'Authentication Bypass' refers to a bypass of the secondary permission gate, not of authentication itself.

RemediationAI

Upgrade Devolutions Server beyond version 2026.1.19 per the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0014/. An exact patched version number was not provided in the available data - consult the Devolutions advisory directly to confirm the specific release that resolves CVE-2026-9590 before upgrading. As a compensating control, organizations should audit and minimize the number of accounts granted 'entry edit' privileges to reduce the exposed attack surface, and review audit logs for any unexpected modifications to asset information that may indicate prior exploitation. Restricting the 'entry edit' role to only fully trusted users limits blast radius while a patched version is deployed. No significant side effects from the privilege scoping workaround are anticipated beyond operational overhead.