PatchTheCVECVE-2026-9522: Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allow
CVE-2026-9522 is a medium-severity flaw (CVSS 5.4) affecting devolutions server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.4 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 97%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2026-06-02 |
| Last modified | 2026-07-22 |
Last updated 2026-07-22 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-9522?
devolutions server: upgrade to 2026.1.20.0. Exact commands for each OS are on this page.
Is CVE-2026-9522 being exploited?
CVE-2026-9522 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-9522 affect?
CVE-2026-9522 affects devolutions server. Severity is medium (CVSS 5.4). Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.
How urgent is CVE-2026-9522?
Priority 20/100. No elevated risk signals yet.
Related CVEs
- CVE-2026-6706 MEDIUM 6.5 UPGRADE Improper access control in the vault documentation feature in Devolutions Server allows an authenticated att
- CVE-2026-5175 MEDIUM 5.0 UPGRADE Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows a
- CVE-2026-4828 HIGH 8.2 UPGRADE Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a
- CVE-2026-4927 MEDIUM 6.5 UPGRADE Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user manage
- CVE-2026-4829 MEDIUM 5.4 UPGRADE Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier