Medium severity4.3NVD Advisory· Published May 22, 2026· Updated May 22, 2026
CVE-2026-9223
CVE-2026-9223
Description
Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*range: <2026.1.19.0
- (no CPE)range: <=2026.1.16.0
Patches
Vulnerability mechanics
References
1- devolutions.net/security/advisories/DEVO-2026-0013/nvdVendor Advisory
News mentions
1- Devolutions Server: Nine CVEs Disclosed in Single Advisory — MFA Bypass, Auth Flaws, and Access Control GapsVypr Intelligence · May 22, 2026