PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-15637 Devolutions CVE debrief

CVE-2026-15637 is an improper authorization vulnerability in Devolutions Server 2026.2.11 and 2026.1.22. The PAM SSH key and certificate retrieval endpoints allow an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. This vulnerability has a high CVSS score of 7.5 and is classified as HIGH severity. Users of Devolutions Server versions 2026.2.11 and 2026.1.22 should apply patches or mitigations to prevent exploitation of this vulnerability. The vulnerability exists due to improper authorization in the PAM SSH key and certificate retrieval endpoints.

Vendor
Devolutions
Product
Devolutions Server
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-20
Advisory published
2026-07-14
Advisory updated
2026-07-20

Who should care

Users of Devolutions Server versions 2026.2.11 and 2026.1.22 should apply patches or mitigations to prevent exploitation of this vulnerability. This includes administrators, security teams, and operators who manage Devolutions Server installations. The vulnerability can be exploited by an authenticated low-privileged user, which highlights the importance of restricting access to sensitive endpoints and credentials.

Technical summary

The vulnerability exists in the PAM SSH key and certificate retrieval endpoints of Devolutions Server. An authenticated low-privileged user can exploit this vulnerability to disclose the private key of an SSH key or certificate PAM credential by directly referencing the credential identifier. This vulnerability is caused by improper authorization in the affected endpoints. The CVSS score of 7.5 indicates a high severity vulnerability.

Defensive priority

High

Recommended defensive actions

  • Apply patches or updates provided by Devolutions to address the vulnerability
  • Restrict access to sensitive endpoints and credentials
  • Monitor for suspicious activity and implement compensating controls
  • Inventory and audit Devolutions Server installations for potential exposure
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-14T19:16:51.013Z and was last modified on 2026-07-20T02:11:10.350Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Devolutions Server versions 2026.2.11 and 2026.1.22. The PAM SSH key and certificate retrieval endpoints allow an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. Evidence limits suggest that further verification is required to confirm affected scope and severity.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-14T19:16:51.013Z and has not been modified since then. The NVD entry is currently Analyzed.