EUVD-2026-88999
GHSA-mgxj-6q88-mxcg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliveryCraft malicious partial connection API request
-
ExploitBypass missing authorization check
-
ExecutionRead/create/modify/delete System Vault entries
-
ImpactExfiltrate or tamper with stored secrets
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privileged account on the Devolutions Server instance and the ability to reach the 'partial connection API' endpoint over the network. The specific trigger is a crafted API request to that partial connection API that exercises operations on System Vault entries the account is not authorized for. Limiting factors: the attacker must already hold valid (if low-privileged) credentials (PR:L), the flaw is confined to the System Vault access path through this particular API, and vendor-fixed builds (2026.3.7.0 and later) remove the exposure; no user interaction and no non-default configuration are required beyond having the server deployed with normal multi-user access. |
| Impact | This is a genuine but modest-priority issue, correctly scored MEDIUM. The CVSS vector (AV:N/AC:L/PR:L/UI:N) describes network-reachable, low-complexity exploitation requiring only an authenticated low-privileged account - a realistic insider or compromised-credential scenario rather than a pre-auth internet attack. All signals converge on LOW real-world urgency: SSVC rates Exploitation 'none', Automatable 'no', and Technical Impact 'partial'; there is no EPSS score, no CISA KEV listing, and no public POC identified at time of analysis. The impact is bounded to C:L/I:L - however, this understates one dimension: the description explicitly includes create/modify/DELETE of System Vault entries, which is a stronger integrity (and arguably availability) impact than C:L/I:L/A:N conveys, since a vault is a secrets store and tampering/deletion could disrupt dependent services. The CWE (CWE-862 Missing Authorization) and the description both indicate a horizontal/vertical privilege-boundary flaw, NOT an authentication bypass as one tag claims - the attacker is already authenticated. Net: a vendor-reported, patched access-control bug with no evidence of exploitation; prioritize patching but it does not warrant emergency response. |
| Exploit ScenarioDerived | An authenticated low-privileged Devolutions Server user crafts a request to the partial connection API that omits or alters the authorization context, causing the server to return or accept operations on System Vault entries the user should not be able to touch. The attacker reads secrets they are not entitled to, or creates/modifies/deletes vault entries to tamper with stored credentials. No public exploit code has been identified and SSVC marks exploitation status as none; exploitation requires a valid low-privileged account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Improper access control in the partial connection API of Devolutions Server (reported as 2026.3.5.0 and earlier; EUVD tracks all builds prior to 2026.3.7.0) lets an authenticated low-privileged user read, create, modify, and delete System Vault entries through a crafted API request. Exploitation requires valid credentials on the instance plus network reachability to the endpoint, with no user interaction and no non-default configuration needed; the notable concern is integrity of the stored privileged secrets, reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L and an overall MEDIUM rating rather than a high-severity emergency. No public exploit code has been identified and SSVC records Exploitation: none, so there is no evidence of active exploitation at time of analysis; a vendor fix is available in 2026.3.7.0.
RemediationAI
Vendor-released patch: upgrade to Devolutions Server 2026.3.7.0 or later, which EUVD records as the first fixed build and which the vendor advisory DEVO-2026-0034 confirms as the remediation path; consult https://devolutions.net/security/advisories/DEVO-2026-0034/ for any intermediate hotfix guidance. Where an immediate upgrade is not possible, the most effective compensating control is to restrict network access to the Devolutions Server web/API surface - particularly the partial connection API - to trusted management networks or VPN ranges, accepting the trade-off that legitimate remote and partner-launched connections through that API will break for anyone outside the allowed ranges. In parallel, audit accounts holding low-privileged roles and remove or disable any that do not strictly need to launch connections, since the flaw requires only an authenticated low-privileged session; this reduces the pool of viable attackers but does not remove the underlying missing-authorization defect. Because access to System Vault entries may have already occurred, review audit and API logs for unexpected read, create, modify, or delete operations on System Vault objects by low-privileged accounts, and rotate the credentials stored in the System Vault if any such activity is found - rotation is disruptive to dependent integrations but is the only way to recover from potential secret exposure. No public exploit code exists at time of analysis, so emergency actions such as taking the service offline are not warranted; treat this as a scheduled, priority-medium patching task.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause maps to CWE-862 (Missing Authorization): a server-side authorization check on the partial connection API route was insufficient, so the endpoint performed actions on System Vault entries without verifying that the calling account held rights over those entries. Devolutions Server is a privileged access management platform, and the System Vault is where the platform's own privileged credentials and secrets are stored, which is why an authorization gap on this specific path has a disproportionate integrity impact despite a low-privileged starting account. The 'partial connection' API is the mechanism by which launched connections are brokered so that credentials can be injected into a session without being revealed to the client, meaning the API naturally handles credential-bearing objects and is reachable over normal authenticated network access. The supplied CPE record, cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*, is fully wildcarded on version and therefore only identifies the vendor-product pairing; precise version boundaries must come from the vendor advisory DEVO-2026-0034 and the EUVD range, which fixes the lower exposure window at 'Server 0 < 2026.3.7.0'. The associated tags reference Server, Devolutions, Authentication Bypass, and Hashicorp, consistent with a PAM product whose vault and credential-brokering surface is the affected component; SSVC assesses the issue as not automatable with partial technical impact.
Know when Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Network API reachable by any authenticated low-priv user (PR:L, AC:L); create/modify/delete of vault entries raises integrity to I:H and adds A:L, while unauthorized read is C:L.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
3DescriptionCVE.org
Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injectio
Account takeover in self-hosted Bitwarden Server before 2026.6.0 lets a low-privileged organization member steal any oth
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any accoun
Provider service users in Bitwarden Server Cloud can hijack arbitrary organizations via unauthorized API endpoint access
NoMachine Server is affected by Integer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack compl
NoMachine Server is affected by Buffer Overflow. Rated high severity (CVSS 8.8), this vulnerability is low attack comple
Authentication bypass in Bitwarden Server versions prior to 2026.4.1 allows authenticated users with SCIM management pri
JetAudio jetCast Server 2.0 contains a stack-based buffer overflow vulnerability in the Log Directory configuration fiel
Credential-holding attackers can completely bypass TOTP two-factor authentication on Sync-in Server versions prior to 2.
A broken authentication vulnerability in 4D SAS 4D Server software v17, v18, v19 R7, and earlier allows attackers to sen
An information disclosure vulnerability in 4D SAS 4D Server Application v17, v18, v19 R7 and earlier allows attackers to
Privilege escalation in self-hosted Bitwarden Server before 2026.5.0 lets an authenticated organization member holding a
Exploit-DB