anonhaven

CVE-2026-17569

MEDIUM CVSS 3.1: 4.3 EPSS 0.27%
Updated Aug 03, 2026
Devolutions
Parameter Value
CVSS 4.3 (MEDIUM)
Affected Versions 2026.2.4.0 — 2026.2.14.0
Fixed In 2026.1.24.0
Type CWE-522 (Insufficiently Protected Credentials)
Vendor Devolutions
Public PoC No

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-522 Insufficiently Protected Credentials

Vulnerable Products 2

Configuration From (including) Up to (excluding)
Devolutions Devolutions_Server
cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
 — 2026.1.24.0
Devolutions Devolutions_Server
cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
 2026.2.4.0 2026.2.14.0

References 1

https://devolutions.net/security/advisories/DEVO-2026-0026/
security@devolutions.net
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-9226

Authentication

6.8

CVE-2026-105488

Devolutions

7.1

CVE-2026-78417

Devolutions

4.3

CVE-2026-8497

Apple

7.4

CVE-2026-17570

Devolutions

4.3