CVE-2026-9247
LowCVSS 2.4Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In Devolutions Server, insufficient logging in the entry export feature allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request.
Risk Assessment
The risk is that sealed entries can be disclosed by an authorized user without administrator knowledge, violating security and audit policies.
Recommendation
It is recommended to update Devolutions Server to a version later than 2026.1.16.0 or 2025.3.20.0, which contains a fix for this issue.
Original NVD description (English source)
Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier