Devolutions Server EUVD-2026-35182

Exploitation requires a valid authenticated account in Devolutions Server with at minimum low-privilege access (confirmed by CVSS PR:L). Additionally, at least one ticketing integration (e.g., Jira, ServiceNow, or similar) must be configured within the Devolutions Server instance - if no ticketing integrations are configured, there are no credentials to expose. The attack is conducted over the network via a crafted API request (AV:N, AC:L), requires no user interaction, and no elevated privileges beyond a basic authenticated session. Exploitation is limited to accounts that can authenticate to the Devolutions Server instance; external unauthenticated attackers cannot exploit this directly. The specific API endpoint targeted is not named in available data and should be confirmed via the vendor advisory.

The CVSS 3.1 base score of 6.5 (Medium) accurately reflects the primary constraint: the attack requires a valid low-privileged account (PR:L), limiting the attack surface compared to unauthenticated vulnerabilities. However, the Confidentiality impact is rated High (C:H), and the network vector (AV:N) with low complexity (AC:L) and no user interaction (UI:N) means any authenticated user on the network can exploit this deterministically. In environments where ticketing integrations (e.g., Jira, ServiceNow, Zendesk) are configured, the leaked credentials may grant access to external systems far beyond Devolutions Server itself, creating lateral movement risk. No EPSS score was provided in the input data, so probabilistic exploitation likelihood cannot be quantified. No KEV listing exists, and no public proof-of-concept has been identified, suggesting exploitation remains opportunistic rather than widespread. The combination of insider-threat relevance and potential for credential reuse elevates real-world priority above the raw CVSS score implies.

An attacker with a low-privileged Devolutions Server account - such as a contractor, help desk user, or compromised standard user - crafts an API request targeting the ticketing integration settings endpoint without the authorization checks enforced for higher-privileged roles. The response returns cleartext credentials for configured integrations (e.g., a Jira service account password or API token), which the attacker then uses to access those external systems. No public exploit code has been identified at time of analysis, but the low complexity rating indicates this is straightforward to reproduce by any authenticated user who inspects API traffic.