Devolutions Server EUVD-2026-89018

Exploitation requires an authenticated low-privileged account on Devolutions Server (version 2026.3.5.0 and earlier, fixed in 2026.3.7.0) and the ability to send a crafted request to the attachment history API. The limiting factors are that valid credentials are mandatory (PR:L - this is not remotely exploitable by anonymous attackers) and impact is confined to deleting or restoring vault attachments; there is no confidentiality exposure and no code execution. No special non-default configuration is needed beyond having vault attachments present and a low-privileged principal.

This is a genuinely moderate, not high, priority. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) describes a network-reachable but authenticated flaw with only partial integrity and availability impact and no confidentiality exposure - consistent with a missing-authorization (CWE-862) issue rather than a code-execution or data-theft bug. All exploitation signals point away from urgency: SSVC records Exploitation=none, Automatable=no, and Technical Impact=partial, meaning CISA's framework does not see active exploitation or scalable automated abuse. There is no EPSS score, no CISA KEV listing, and no public exploit code, so the correct exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent - a self-reported, vendor-patched authorization gap with low real impact - with no conflicts between the CVSS vector, the description (both indicate an authenticated low-privileged actor), and the SSVC verdict. The only caveat is that the CVSS impact is bounded to attachment deletion/restoration, so the practical harm is limited to loss/manipulation of vault attachment data rather than broader compromise.

An authenticated low-privileged Devolutions Server user who lacks rights over certain vault attachments sends a crafted request to the attachment history API, which fails to enforce authorization, and thereby permanently deletes or restores attachments they should not be able to touch. Because AC:L and no user interaction are required, the request is straightforward to issue once the attacker holds any valid low-privilege account. No public proof-of-concept exploit code has been identified at time of analysis.