Devolutions Server EUVD-2026-33935

Exploitation requires the attacker to be authenticated to Devolutions Server with at least 'entry edit' privileges - this is an insider or compromised-account scenario, not an unauthenticated remote attack. The CVSS vector PR:N conflicts with this description-stated requirement and should be treated with caution until vendor clarification is available. The target system must be running Devolutions Server version 2026.1.19 or earlier. No special network positioning beyond connectivity to the Devolutions Server web interface is required (AV:N, AC:L). Exploitation is limited by the need for a valid authenticated session with entry edit rights; unauthenticated or unprivileged users cannot trigger this flaw. There is no user interaction required beyond the attacker's own actions.

The CVSS base score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N presents a notable inconsistency with the vulnerability description: PR:N implies no authentication is required, yet the description explicitly states the attacker must be 'an authenticated user with entry edit privileges.' This conflict should be verified with the Devolutions vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0014/ before relying on the CVSS vector for access-control decisions. The realistic attack surface is therefore narrower than PR:N implies - exploitation requires an insider or compromised account with at least entry edit privileges. Impact is limited to integrity (I:L) with no confidentiality or availability consequence, reducing overall urgency. EPSS data was not provided; given the authenticated requirement and bounded impact, real-world exploitation probability is likely low. No KEV listing and no known POC further support treating this as a medium-priority issue, particularly relevant to organizations with untrusted internal users or contractor accounts in Devolutions Server deployments.

An authenticated internal user or contractor who holds entry edit privileges in Devolutions Server sends a crafted API or UI request to the asset modification endpoint, omitting or bypassing the secondary permission check. The server's permission validation component fails to enforce the additional asset-modification gate, allowing the write operation to succeed. The attacker can alter asset metadata or configuration data they are not authorized to change, potentially manipulating privileged account records stored within the PAM platform.