CVE-2026-15637: Devolutions Server Info Disclosure Flaw

CVE-2026-15637 Overview

CVE-2026-15637 is an improper authorization vulnerability in Devolutions Server 2026.2.11 and 2026.1.22. The flaw affects the Privileged Access Management (PAM) SSH key and certificate retrieval endpoints. Authenticated low-privileged users can disclose the private key material of an SSH key or certificate PAM credential. Exploitation relies on a direct object reference to the credential identifier, classified under [CWE-639]. The vulnerability enables horizontal privilege escalation by leaking secrets that were intended to be restricted by role-based access controls.

Critical Impact
An authenticated low-privileged attacker can retrieve private SSH keys and certificate credentials managed by Devolutions Server PAM, undermining downstream systems that rely on those secrets for authentication.

Affected Products

Devolutions Server 2026.2.11
Devolutions Server 2026.1.22
Devolutions Server PAM module (SSH key and certificate retrieval endpoints)

Discovery Timeline

2026-07-14 - CVE-2026-15637 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-15637

Vulnerability Analysis

The vulnerability resides in the PAM SSH key and certificate retrieval endpoints of Devolutions Server. These endpoints accept a credential identifier as a direct object reference but fail to verify whether the requesting user is authorized to access that specific credential. As a result, any authenticated account, including low-privileged users, can request arbitrary PAM credential identifiers and receive the associated private key material.

The exposure covers SSH private keys and certificate PAM credentials stored in the vault. Because Devolutions Server manages privileged access to remote systems, disclosure of these keys can allow lateral movement to any host that trusts the leaked credential. The attack requires only network reach to the server and a valid low-privileged session.

Root Cause

The root cause is missing object-level authorization on the SSH key and certificate retrieval endpoints. The endpoints authenticate the caller but do not enforce the vault-level or entry-level permissions that gate normal credential access. This is an Insecure Direct Object Reference (IDOR) pattern mapped to [CWE-639].

Attack Vector

An authenticated attacker sends a direct request to the vulnerable PAM retrieval endpoint, supplying the identifier of a PAM SSH key or certificate credential they do not own. The server returns the private key material without checking access rights. Refer to the Devolutions Security Advisory DEVO-2026-0024 for endpoint-level technical details. No verified proof-of-concept code has been published.

Detection Methods for CVE-2026-15637

Indicators of Compromise

Unexpected GET or POST requests to PAM SSH key and certificate retrieval endpoints from low-privileged user sessions.
Retrieval events for PAM credentials that the calling user has no legitimate business need to access.
Sequential or enumerated credential identifiers appearing in access logs within short time windows.

Detection Strategies

Audit Devolutions Server activity logs for PAM credential access events and correlate them against the user's assigned vault permissions.
Alert when a single account retrieves multiple distinct SSH key or certificate credentials in a short interval, which indicates enumeration.
Monitor downstream SSH servers for authentications using PAM-managed keys from unexpected source hosts or accounts.

Monitoring Recommendations

Forward Devolutions Server audit logs to a centralized SIEM for retention and correlation with authentication telemetry.
Establish a baseline of normal PAM credential retrieval volume per user and alert on deviations.
Track SSH host key and certificate usage on protected endpoints to identify credentials that may have been exfiltrated.

How to Mitigate CVE-2026-15637

Immediate Actions Required

Upgrade Devolutions Server to a fixed release published by the vendor as listed in Devolutions Security Advisory DEVO-2026-0024.
Rotate all SSH keys and certificate PAM credentials stored in Devolutions Server that may have been accessible during the exposure window.
Review audit logs to identify low-privileged accounts that queried PAM SSH key or certificate endpoints.

Patch Information

Devolutions has published remediation guidance in Devolutions Security Advisory DEVO-2026-0024. Administrators should apply the fixed version identified in the advisory to versions 2026.2.11 and 2026.1.22.

Workarounds

Restrict Devolutions Server access to trusted networks until the patch is applied to reduce the pool of authenticated users who can invoke the endpoints.
Temporarily remove or disable low-privileged accounts that do not require access to the server.
Enforce short credential rotation cycles for SSH keys and certificates managed under PAM until upgrade is complete.

bash

# Configuration example
# Review Devolutions Server audit logs for PAM credential retrieval activity
# and identify accounts accessing SSH key or certificate entries outside their scope.
# Consult the vendor advisory for the fixed version string:
#   https://devolutions.net/security/advisories/DEVO-2026-0024/