CVE-2026-9522

Vulnerability

Improper access control in the PAM account discovery feature of Devolutions Server versions 2026.1.19 and earlier allows authenticated users without administrative privileges to delete network discovery scan configurations.

Exploitation

An attacker who is already authenticated to the system and does not possess administrative privileges can exploit this vulnerability by accessing the PAM account discovery feature and initiating the deletion of network discovery scan configurations.

Impact

Successful exploitation allows an authenticated, non-administrative user to delete network discovery scan configurations, potentially disrupting network monitoring and management operations.

Mitigation

Devolutions Server versions 2026.1.19 and earlier are affected. A patched version is available. Please refer to the vendor advisory for specific version details and release dates [1].