CVE-2026-9248 Devolutions CVE debrief

Who should care

Administrators and users of Devolutions Server, especially those with write access to vaults, should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes updating Devolutions Server to a version outside the affected range, restricting write access to vaults for users who do not need it, and monitoring for suspicious activity related to entry duplication.

Technical summary

The vulnerability has a CVSS score of 2.6 and a severity of LOW. It allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access. The affected versions are Devolutions Server 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. This issue is an authorization bypass vulnerability in the entry duplication feature of Devolutions Server.

Defensive priority

Low

Recommended defensive actions

• Update Devolutions Server to a version outside the affected range
• Restrict write access to vaults for users who do not need it
• Monitor for suspicious activity related to entry duplication
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-05-22T16:16:25.860Z and last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request.

Official resources