anonhaven

CVE-2026-17570

MEDIUM CVSS 3.1: 4.3 EPSS 0.25%
Updated Aug 03, 2026
Devolutions
Parameter Value
CVSS 4.3 (MEDIUM)
Affected Versions 2026.2.4.0 — 2026.2.14.0
Fixed In 2026.1.24.0
Type CWE-639 (Authorization Bypass)
Vendor Devolutions
Public PoC No

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

Attack Parameters

Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed

Impact Assessment

Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption

CVSS Vector v3.1

Weakness Type (CWE)

CWE-639 Authorization Bypass

Vulnerable Products 2

Configuration From (including) Up to (excluding)
Devolutions Devolutions_Server
cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
 — 2026.1.24.0
Devolutions Devolutions_Server
cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
 2026.2.4.0 2026.2.14.0

References 1

https://devolutions.net/security/advisories/DEVO-2026-0026/
security@devolutions.net
Share Post Share Share Share

Related Vulnerabilities

CVE-2026-9226

Authentication

6.8

CVE-2026-105488

Devolutions

7.1

CVE-2026-78417

Devolutions

4.3

CVE-2026-8497

Apple

7.4

CVE-2026-17569

Devolutions

4.3