CVE-2026-9522: Improper Access Control in Devolutions Server PAM Discovery

Technical summary

CVE-2026-9522 stems from improper access control (CWE-284) in Devolutions Server's PAM account discovery module. The vulnerability allows any authenticated user to perform deletion operations on network discovery scan configurations regardless of their privilege level. The CVSS 3.1 score of 5.4 (MEDIUM) reflects low confidentiality and integrity impact without availability impact—users can view and modify configurations they should not access, but the system itself remains operational. The network-accessible attack vector and low complexity mean exploitation requires only valid credentials and no user interaction.

Business impact

Organizations relying on Devolutions Server for PAM and account discovery face operational disruption and compliance risk. Malicious or negligent non-admin users can delete scan configurations, preventing discovery of privileged accounts and breaking automated inventory processes. This can lead to incomplete asset visibility, delayed vulnerability assessments, and audit failures if regulatory frameworks require comprehensive account tracking. Additionally, recovery of deleted configurations consumes administrative time and may leave windows of unmonitored access.

Affected systems

Devolutions Server versions 2026.1.19 and earlier are affected. Organizations should verify their exact version and check the vendor advisory for patched versions. The vulnerability requires valid authentication, so it does not affect unauthenticated or internet-facing attack scenarios where no credentials are available.

Exploitability

Exploitation is straightforward and requires only valid user credentials with low or no privilege level. No exploit code or sophisticated techniques are needed—any authenticated non-admin user can access the PAM discovery interface and delete scan configurations through normal UI or API interactions. The lack of KEV (Known Exploited Vulnerabilities) status indicates no public active exploitation has been documented, but the low technical barrier means defenders should assume eventual weaponization if patches are delayed.

Remediation

Update Devolutions Server to the patched version specified in the vendor security advisory. Verify the exact patched version against Devolutions' official guidance before deployment. As an interim control, restrict PAM account discovery feature access to administrative users only via role-based access control (RBAC) if the product permits temporary scope narrowing. Audit logs to identify any unauthorized deletion of scan configurations and restore them from backup if available.

Patch guidance

Consult the Devolutions security advisory for the specific patched version addressing CVE-2026-9522. Apply patches in a test environment first to verify compatibility with your PAM workflows and integrations. Given the MEDIUM severity, plan patching within your standard update cycle, but prioritize systems where non-admin users have broad access to the discovery feature. Document any pre-patch configurations and consider backup restoration procedures.

Detection guidance

Monitor Devolutions Server audit logs for deletion events on network discovery scan configurations, particularly those initiated by non-administrative users. Alert on any configuration changes to the PAM account discovery module from unexpected accounts. If available, enable detailed access control logging within Devolutions Server to track privilege escalation attempts or unauthorized configuration modifications. Review user access permissions to the account discovery feature and cross-reference against expected role assignments.

Why prioritize this

While rated MEDIUM severity with a CVSS score of 5.4, this vulnerability merits near-term attention because it directly impacts PAM hygiene and compliance. Unlike purely confidentiality-focused issues, the ability to delete discovery configurations creates operational risk—audit trails may show missing accounts, and attackers could hide privileged accounts by disrupting scans. Organizations with mature PAM programs and regulatory requirements (SOX, HIPAA, PCI-DSS) should treat this with higher urgency despite the moderate score.

Risk score, explained

The CVSS 3.1 score of 5.4 (MEDIUM) reflects the following: (1) Network-accessible attack vector with low complexity and low privilege requirements keep the score from 'LOW', (2) Confidentiality and integrity impact are rated 'LOW' because deletion affects configurations, not direct exposure of sensitive data, (3) No availability impact is assigned because scan deletions do not crash the server or deny service to other users. The score appropriately captures a privilege boundary bypass with operational consequences but no critical infrastructure disruption.

Frequently asked questions