CVE-2026-17569

Published: Jul 27, 2026Modified: Aug 3, 2026

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability: 2.8 / Impact: 1.4

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

Affected (2)

Products: Devolutions: Devolutions Server

1 product

Devolutions Server

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Devolutions Devolutions Server	Before 2026.1.24.0
Devolutions Devolutions Server	From 2026.2.4.0 to 2026.2.14.0

Related CWEs

Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

References (1)

https://devolutions.net/security/advisories/DEVO-2026-0026/

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.