CVE-2026-9246: Medium severity Devolutions Devolutions Server vulnerability
Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request.
This issue affects :
Devolutions Server 2026.1.6.0 through 2026.1.16.0 Devolutions Server 2025.3.20.0 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Audit and restrict users and groups that have vault read access so only accounts that require it retain that permission; remove vault-read privileges from service accounts or users that do not need to retrieve entry data.
Devolutions Server vault_read_access = limit to minimum necessary users/groups - Compensating control
Restrict network access to Devolutions Server management and API endpoints to trusted IPs or networks (via firewall, VPN, or WAF) to reduce exposure to authenticated users from untrusted networks.
- Operational
Monitor and review access logs for API requests accessing entry documentation and attachments (especially requests targeting sealed entries); investigate and remove any suspicious tokens/accounts and revoke or rotate credentials used by compromised or unnecessary accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9246?
CVE-2026-9246 has a risk rating of 47, indicating a moderate severity level.
How do I fix CVE-2026-9246?
To mitigate CVE-2026-9246, ensure you update to Devolutions Server version 2026.1.6.1 or later.
Who is affected by CVE-2026-9246?
Authenticated users with vault read access in Devolutions Server versions 2026.1.6.0 and earlier are at risk.
What kind of access issue does CVE-2026-9246 involve?
CVE-2026-9246 involves improper access control, allowing unauthorized retrieval of documentation and attachments.
How does CVE-2026-9246 exploit Devolutions Server?
CVE-2026-9246 can be exploited through a crafted API request by authenticated users.