PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9248 Devolutions CVE debrief

CVE-2026-9248 is an authorization bypass vulnerability in the entry duplication feature of Devolutions Server. An authenticated user with write access to any vault can copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The vulnerability has a CVSS score of 2.6 and a severity of LOW.

Vendor
Devolutions
Product
Devolutions Server
CVSS
LOW 2.6
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-07-23
Advisory published
2026-05-22
Advisory updated
2026-07-23

Who should care

Administrators and users of Devolutions Server, especially those with write access to vaults, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes updating Devolutions Server to a version outside the affected range, restricting write access to vaults for users who do not need it, and monitoring for suspicious activity related to entry duplication.

Technical summary

The vulnerability has a CVSS score of 2.6 and a severity of LOW. It allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access. The affected versions are Devolutions Server 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. This issue is an authorization bypass vulnerability in the entry duplication feature of Devolutions Server.

Defensive priority

Low

Recommended defensive actions

  • Update Devolutions Server to a version outside the affected range
  • Restrict write access to vaults for users who do not need it
  • Monitor for suspicious activity related to entry duplication
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-05-22T16:16:25.860Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9248 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9248

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9248 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9248

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.