CVE-2026-9247

LOW2.4

Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request

Published May 22, 2026

Modified 1 months ago

Details

Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request.

This issue affects :

Devolutions Server 2026.1.6.0 through 2026.1.16.0
Devolutions Server 2025.3.20.0 and earlier

References

WEB

https://devolutions.net/security/advisories/DEVO-2026-0013/

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-9247

CVSS Analysis

CVSS v3.1

2.4

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

HighPR:H

User Interaction

RequiredUI:R

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

2.4/CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weakness Type (CWE)

Other

CWE-778

Ecosystems

Timeline

PublishedMay 22, 2026

ModifiedMay 22, 2026