CVE-2026-15642: Devolutions Server Info Disclosure Flaw

CVE-2026-15642 Overview

CVE-2026-15642 is an information disclosure vulnerability in Devolutions Server 2026. The Recovery Kit response file generation feature writes the Azure Key Vault client secret in cleartext into the generated response file. This occurs even when the operator selects the option to exclude sensitive data. An attacker with access to the generated file can read the client secret and reuse it to authenticate against the associated Azure Key Vault. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and is documented in the Devolutions Security Advisory DEVO-2026-0024.

Critical Impact
An attacker who obtains the generated Recovery Kit response file recovers the Azure Key Vault client secret in cleartext, enabling unauthorized access to secrets stored in the vault.

Affected Products

Devolutions Server 2026.1.22.0
Devolutions Server 2026.2.11.0
Recovery Kit response file generation feature

Discovery Timeline

2026-07-14 - CVE-2026-15642 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15642

Vulnerability Analysis

The vulnerability resides in the Recovery Kit response file generation feature of Devolutions Server. Recovery Kit response files are intended to capture configuration necessary to restore or reprovision a Devolutions Server instance. The workflow provides an option to exclude sensitive data from the exported file so administrators can share or store the artifact with reduced risk.

The feature fails to honor this exclusion for the Azure Key Vault client secret. The secret is written in cleartext into the response file regardless of the operator's selection. Because the secret authenticates the server to Azure Key Vault, any party that reads the file gains the ability to request secrets from the vault under the identity of the Devolutions Server principal.

Exploitation requires local access to the generated file and user interaction to produce it. The impact is limited to confidentiality of the Azure Key Vault credential and any secrets reachable through that credential.

Root Cause

The response file generator does not apply the sensitive-data exclusion filter to the Azure Key Vault client secret field. The value is serialized in its original cleartext form during export. This is a business logic and output sanitization defect classified as [CWE-200].

Attack Vector

An attacker requires read access to the Recovery Kit response file produced by an administrator. Access paths include shared storage, backup repositories, ticketing attachments, or endpoints where the file is transferred. Once obtained, the attacker parses the file and extracts the client secret string. No exploit code is required beyond reading the file.

The vulnerability description in the Devolutions advisory confirms the behavior and affected versions. No public proof of concept is available.

Detection Methods for CVE-2026-15642

Indicators of Compromise

Recovery Kit response files stored outside approved secure locations, particularly in file shares, email attachments, or ticket systems.
Azure Key Vault access events originating from unexpected IP addresses or clients using the service principal associated with Devolutions Server.
Authentication events showing reuse of the Azure Key Vault client secret from hosts other than the Devolutions Server.

Detection Strategies

Inventory all Recovery Kit response files generated by affected versions and inspect them for the presence of an azureKeyVault client secret value in cleartext.
Correlate Devolutions Server export activity with subsequent Azure Key Vault authentication events to identify suspicious sequences.
Enable Azure Key Vault diagnostic logging and monitor SecretGet and SecretList operations for anomalous callers.

Monitoring Recommendations

Forward Azure Key Vault audit logs to a centralized analytics platform and alert on authentications outside expected source ranges.
Track file creation and access events for Recovery Kit output directories on Devolutions Server hosts.
Alert on any use of the Azure Key Vault service principal from workstations rather than the designated server.

How to Mitigate CVE-2026-15642

Immediate Actions Required

Rotate the Azure Key Vault client secret used by Devolutions Server if a Recovery Kit response file has been generated on an affected version.
Locate and securely delete any Recovery Kit response files generated by the affected versions, including copies on backups and shared storage.
Restrict permissions on directories where Recovery Kit files are produced and stored to authorized administrators only.
Review Azure Key Vault access logs for unauthorized use of the client secret since the affected versions were deployed.

Patch Information

Refer to the Devolutions Security Advisory DEVO-2026-0024 for the fixed version of Devolutions Server and upgrade guidance. Apply the vendor-supplied update to versions later than 2026.1.22.0 and 2026.2.11.0 as directed by the advisory.

Workarounds

Avoid generating Recovery Kit response files on affected versions until the patch is applied.
If a response file must be generated, treat the output as a secret, store it in an encrypted location, and rotate the Azure Key Vault client secret immediately after use.
Use a dedicated Azure Key Vault service principal for Devolutions Server with least-privilege access policies to limit exposure if the secret is disclosed.

bash

# Configuration example
# After patching, rotate the Azure Key Vault client secret via Azure CLI
az ad app credential reset \
  --id <application-id> \
  --display-name "devolutions-server-rotated" \
  --years 1

# Restrict access to Recovery Kit output directory (Windows PowerShell)
icacls "C:\ProgramData\Devolutions\Server\RecoveryKit" /inheritance:r
icacls "C:\ProgramData\Devolutions\Server\RecoveryKit" /grant:r "Administrators:(OI)(CI)F"