CVE-2026-15637CWE-639

CVE-2026-15637

High · published July 14, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

Improper authorization in the PAM SSH key and certificate retrieval

endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an

authenticated low-privileged user to disclose the private key of an SSH

key or certificate PAM credential via a direct object reference to the

credential identifier.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00253 · 16.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-14T23:16Z
Affected products (2)
ProductVersionsFixed in
devolutions/devolutions_server< 2026.1.23.02026.1.23.0
devolutions/devolutions_server≥ 2026.2.0.0, < 2026.2.12.02026.2.12.0
References (1)
https://devolutions.net/security/advisories/DEVO-2026-0024/ · [email protected]
EPSS history
Timeline
  • 14 JUL 18:05Z
    Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated…
    cvelistv5