PT-2026-42789 · Devolutions · Server

Published 2026-05-22 · Updated 2026-05-22 · CVE-2026-9223

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Missing authorization in the vault import feature in Devolutions Server  2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-9223

Affected Products

Server

References · 1

• https://devolutions.net/security/advisories/DEVO-2026-0013 · Note