PatchTheCVECVE-2026-9223: Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-
CVE-2026-9223 is a medium-severity flaw (CVSS 4.3) affecting devolutions server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 88%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2026-05-22 |
| Last modified | 2026-07-23 |
Last updated 2026-07-23 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-9223?
devolutions server: upgrade to 2026.1.19.0. Exact commands for each OS are on this page.
Is CVE-2026-9223 being exploited?
CVE-2026-9223 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-9223 affect?
CVE-2026-9223 affects devolutions server. Severity is medium (CVSS 4.3). Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request.
How urgent is CVE-2026-9223?
Priority 18/100. No elevated risk signals yet.
Software pages
HashiCorp Vault vulnerabilities
Related CVEs
- CVE-2026-6706 MEDIUM 6.5 UPGRADE Improper access control in the vault documentation feature in Devolutions Server allows an authenticated att
- CVE-2026-5175 MEDIUM 5.0 UPGRADE Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows a
- CVE-2026-4828 HIGH 8.2 UPGRADE Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a
- CVE-2026-4927 MEDIUM 6.5 UPGRADE Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user manage
- CVE-2026-4829 MEDIUM 5.4 UPGRADE Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier