CVE-2026-15637
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
An improper authorization vulnerability in Devolutions Server allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. The issue affects the PAM SSH key and certificate retrieval endpoints.
Risk Assessment
The organization is at risk of leaking sensitive private SSH keys and PAM certificates, which could lead to unauthorized access to systems and services.
Recommendation
Immediately update Devolutions Server to version 2026.2.12 or later, which includes a fix for the authorization flaw.
Other vulnerabilities in Devolutions Server
See all- CVE-2026-17570Medium
In Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and version 2026.1.23.0 and earlier, improper access control in the PAM password history endpoints allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests.
- CVE-2026-17569Medium
An improper access control vulnerability in the NetBox synchronizer in Devolutions Server. An authenticated user with view-only permission can obtain a stored API token.
- CVE-2026-17568High
An improper access control vulnerability in Devolutions Server allows an authenticated non-administrative user with user-group membership management permission to escalate privileges to administrator via a crafted API request. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier.
- CVE-2026-15642Low
In Devolutions Server 2026.1.22.0 and 2026.2.11.0, the Recovery Kit response file generation feature inserts sensitive information into a file. This allows an attacker with access to the generated file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.
- CVE-2026-15641High
An improper authorization vulnerability in Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request by directly calling the request status endpoint, bypassing the required approver review.
- CVE-2026-15058Low
An improper authorization vulnerability in the secure messages deletion endpoint of Devolutions Server 2026.2.11 and 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.
- CVE-2026-14536High
In Devolutions Server 2026.2.9.0, improper enforcement of a mandatory multi-factor authentication (MFA) policy was found. An attacker with valid user credentials can bypass the MFA Required policy and authenticate without completing multi-factor authentication. The issue occurs when DVLS encounters an invalid default MFA value.
- CVE-2026-12755Low
A vulnerability in Devolutions Server versions 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host. By crafting a DomainName parameter in the PAM AD discovery endpoints, the attacker can capture PAM provider credentials as an NTLMv2 challenge-response.
- CVE-2026-12117Medium
In Devolutions Server 2026.2.5, improper access control in the social login connection endpoint allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized.
- CVE-2026-12105Medium
Improper access control in Devolutions Server 2026.2.5 and 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.
Original NVD description (English source)
Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.