CVE-2026-9249

3th percentile - higher than 3% of all known CVEs

In Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier, unverified password change allows an attacker to change a user's password without providing the previous one via a crafted password change request.

An attacker can take over a user account by changing the password without knowing the old one, leading to unauthorized access to sensitive data.

Update Devolutions Server to a version above 2026.1.16.0 that includes the fix. Enforce verification of the old password during password changes.