CVE-2026-17570 Devolutions CVE debrief

Who should care

Users of Devolutions Server, especially those with low-privileged authenticated users, should assess and potentially update their installations to mitigate the risk of plaintext credential secret disclosure.

Technical summary

The vulnerability, CVE-2026-17570, is due to improper access control in the PAM password history endpoints of Devolutions Server. This allows an authenticated low-privileged user to make crafted API requests that can lead to the disclosure of plaintext credential secrets. The affected versions are Devolutions Server 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier. The CVSS score for this vulnerability is 4.3, indicating a Medium severity level.

Defensive priority

Medium priority should be given to updating Devolutions Server to a version outside the affected range, as the vulnerability allows for the disclosure of sensitive information with relatively low privileges. Additionally, review and restrict API access for low-privileged users, and monitor for suspicious API requests that could indicate exploitation attempts. Consider implementing compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Review compensating controls for exposed systems while remediation is scheduled and verified. Check relevant monitoring, detection, and logs for exposed assets that need extra review. Track exceptions, retest remediated assets, and close the item only after evidence is documented. Consider an asset inventory to identify potentially affected systems and prioritize remediation efforts accordingly. Consider implementing source tracking to monitor for potential exploitation attempts and improve incident response. Consider implementing rollback/change windows to minimize downtime during remediation. Consider reviewing and restricting API access for low-privileged users to prevent similar attacks in the future. Consider monitoring for suspicious API requests that could indicate exploitation attempts to improve incident response. Consider compensating controls for exposed systems while remediation is scheduled and verified to minimize the risk of plaintext credential secret disclosure. Consider reviewing and updating incident response plans to include procedures for responding to potential exploitation attempts. Consider providing additional training to security teams on the vulnerability and its impact.

Recommended defensive actions

• Update Devolutions Server to a version outside the affected range.
• Review and restrict API access for low-privileged users.
• Monitor for suspicious API requests that could indicate exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD detail provide information on the vulnerability. However, further analysis and verification are needed to fully understand the impact and to check if there are any compensating controls that can be implemented until an update is available. The vulnerability affects Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier. Users should verify their installations and consider implementing additional security measures to mitigate the risk of plaintext credential secret disclosure.

Official resources