PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9251 Devolutions CVE debrief

A vulnerability exists in Devolutions Server, specifically in the entry status management feature. This allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow. Consequently, the user can gain access to an entry's data by submitting a crafted status change request. The affected product deployments should be reviewed for exposure, and owners should be assigned for follow-up. The vulnerability class is related to missing authorization, which could lead to unauthorized access and potential data breaches. The source confidence is limited to the information provided by the NVD and the vendor's advisory. This issue requires immediate attention from system administrators and users of Devolutions Server.

Vendor
Devolutions
Product
Devolutions Server
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-22
Original CVE updated
2026-07-23
Advisory published
2026-05-22
Advisory updated
2026-07-23

Who should care

System administrators and users of Devolutions Server, particularly those with non-administrator authenticated access, should be aware of this vulnerability. It is crucial for them to assess the risk and apply necessary patches or mitigations.

Technical summary

The issue arises from missing authorization in the entry status management feature of Devolutions Server. This feature is used to manage the status of entries, and the vulnerability allows a non-administrator authenticated user to bypass the Pending Approval flow. The user can exploit this by crafting a status change request, thereby gaining unauthorized access to an entry's data. The affected versions are Devolutions Server 2026.1.6.0 through 2026.1.16.0 and Devolutions Server 2025.3.20.0 and earlier.

Defensive priority

Medium priority should be given to patching or mitigating this vulnerability, as it allows unauthorized access to entry data. The CVSS score of 5.4 indicates a medium severity level.

Recommended defensive actions

  • Apply the latest patches or updates provided by Devolutions to address the vulnerability.
  • Restrict access to the entry status management feature to only authorized personnel.
  • Monitor and audit user activities within Devolutions Server to detect any suspicious behavior.
  • Implement additional security measures, such as multi-factor authentication, to enhance the overall security posture.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-05-22T16:16:26.070Z and was last modified on 2026-07-23T16:10:00.137Z. The NVD entry is currently Analyzed. The vulnerability details were obtained from the NVD and the vendor's advisory.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-05-22T16:16:26.070Z and has not been modified since then. The NVD entry is currently Analyzed.