CVE-2026-10786: Medium severity Devolutions Devolutions Server vulnerability
Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request.
This issue affects :
Devolutions Server 2026.2.4.0 Devolutions Server 2026.1.20.0 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Devolutions Server ticketing integrationsfrom your environment.Disable or remove ticketing integrations until a vendor-supplied fix is available to prevent cleartext credentials from being retrieved via the API.
- Configuration
Restrict who can view or edit ticketing integration settings (grant only administrator roles) or disable such functionality for non-admin accounts until a fix is applied.
Devolutions Server ticketing integration settings / API access = restrict to administrator roles or disable editing for low-privileged users - Compensating control
Restrict network access to the Devolutions Server management/API endpoints (including ticketing-integration endpoints) to trusted IP ranges or internal networks using firewall rules or network ACLs to reduce exposure to authenticated low-privileged users.
- Operational
Rotate credentials for all configured ticketing integrations and any other credentials that may have been exposed. Update stored credentials after remediation is in place.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10786?
CVE-2026-10786 has a medium severity rating of 6.5 according to the CVSS 3.1 scoring system.
How do I fix CVE-2026-10786?
To remediate CVE-2026-10786, update Devolutions Server to the latest version that addresses this vulnerability.
What is the risk level of CVE-2026-10786?
CVE-2026-10786 has a risk level assigned as 38, indicating moderate concern for the affected systems.
Who is affected by CVE-2026-10786?
CVE-2026-10786 affects users of Devolutions Server versions 2026.2.4.0 and earlier.
What type of vulnerability is CVE-2026-10786?
CVE-2026-10786 is an improper access control vulnerability that allows low-privileged users to obtain cleartext credentials.