CVE-2026-9245 Devolutions CVE debrief

Who should care

Users of Devolutions Server, particularly those using versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes applying patches or updates provided by Devolutions, restricting access to affected systems, and monitoring for suspicious activity.

Technical summary

The vulnerability, CVE-2026-9245, is caused by improper input validation in the external authentication provider flow of Devolutions Server. This allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. The issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The CVSS score for this vulnerability is 5, indicating a medium severity level.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it could allow attackers to redirect users to malicious sites. Defenders should focus on applying vendor patches, reviewing compensating controls, and monitoring affected systems for potential security incidents related to this vulnerability. Implementing additional security measures, such as multi-factor authentication, for accessing Devolutions Server is also recommended. Furthermore, defenders should verify affected systems, review vendor guidance for specific deployment impacts, and consider the potential operational impact of a successful exploit. This may involve coordinating with Devolutions support and tracking the deployment of patches across the organization. Given the medium severity and potential for redirecting users to malicious sites, timely mitigation and verification of defenses are crucial to minimizing risk. The vulnerability's impact on an organization's security posture should be carefully assessed, and appropriate measures should be taken to protect against potential exploitation. This includes ensuring that security teams are aware of the vulnerability and its implications, and that necessary steps are taken to prevent or mitigate potential attacks. By prioritizing the mitigation of this vulnerability, organizations can reduce the risk of a successful exploit and protect their systems and data from potential harm. It is also important to note that evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability, emphasizing the need for defenders to exercise caution and consider the potential for unknown affected scope or impact. Overall, a proactive and thorough approach to addressing this vulnerability is essential to maintaining the security and integrity of affected systems and data. In addition to applying patches, defenders should consider implementing additional security controls, such as monitoring and detection systems, to help identify and respond to potential security incidents related to this vulnerability. By taking a comprehensive and proactive approach to mitigating this vulnerability, organizations canhelp

Recommended defensive actions

• Apply patches or updates provided by Devolutions to fix the vulnerability
• Restrict access to the affected systems until patches can be applied
• Monitor for suspicious activity, particularly redirects to unknown domains
• Implement additional security measures, such as multi-factor authentication, for accessing Devolutions Server
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD detail provide information about the vulnerability. The vendor advisory from Devolutions offers mitigation strategies. Evidence is limited to public sources and may not reflect the full scope or impact of the vulnerability. Defenders should verify affected systems and review vendor guidance for specific deployment impacts.

Official resources