CVE-2026-15637 Devolutions CVE debrief

Who should care

Users of Devolutions Server versions 2026.2.11 and 2026.1.22 should apply patches or mitigations to prevent exploitation of this vulnerability. This includes administrators, security teams, and operators who manage Devolutions Server installations. The vulnerability can be exploited by an authenticated low-privileged user, which highlights the importance of restricting access to sensitive endpoints and credentials.

Technical summary

The vulnerability exists in the PAM SSH key and certificate retrieval endpoints of Devolutions Server. An authenticated low-privileged user can exploit this vulnerability to disclose the private key of an SSH key or certificate PAM credential by directly referencing the credential identifier. This vulnerability is caused by improper authorization in the affected endpoints. The CVSS score of 7.5 indicates a high severity vulnerability.

Defensive priority

High

Recommended defensive actions

• Apply patches or updates provided by Devolutions to address the vulnerability
• Restrict access to sensitive endpoints and credentials
• Monitor for suspicious activity and implement compensating controls
• Inventory and audit Devolutions Server installations for potential exposure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-14T19:16:51.013Z and was last modified on 2026-07-20T02:11:10.350Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Devolutions Server versions 2026.2.11 and 2026.1.22. The PAM SSH key and certificate retrieval endpoints allow an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. Evidence limits suggest that further verification is required to confirm affected scope and severity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.