CVE-2026-9223: Devolutions Server Auth Bypass Vulnerability

CVE-2026-9223 Overview

CVE-2026-9223 is a missing authorization vulnerability in the vault import feature of Devolutions Server. The flaw affects Devolutions Server version 2026.1.16.0 and earlier. A low-privileged authenticated user can create new vaults by sending a crafted import request to the server. The vulnerability is classified under CWE-284: Improper Access Control. Devolutions published advisory DEVO-2026-0013 to address the issue.

Critical Impact
Authenticated low-privileged users can bypass authorization checks to create arbitrary vaults, undermining the privilege model of the privileged access management platform.

Affected Products

Devolutions Server 2026.1.16.0 and earlier
Devolutions Server 2026 release branch
All deployments exposing the vault import API endpoint to authenticated users

Discovery Timeline

2026-05-22 - CVE CVE-2026-9223 published to NVD
2026-05-22 - Last updated in NVD database

Technical Details for CVE-2026-9223

Vulnerability Analysis

The vulnerability exists in the vault import workflow of Devolutions Server. The server fails to verify that the authenticated user holds the required role or permission before processing a vault import request. Any authenticated principal, including accounts with minimal privileges, can submit a crafted import payload. The server processes the request and creates a new vault under the caller's identity.

Devolutions Server is a centralized credential and privileged session management platform. Vaults are the primary container for stored secrets, connections, and entries. Granting unauthorized vault creation expands the attack surface within the tenant. An attacker can use this capability to seed the environment with attacker-controlled vaults that legitimate users may interact with.

Root Cause

The root cause is a missing server-side authorization check on the vault import endpoint. The application enforces authentication but does not validate the caller's role against the vault administration permission set. This pattern aligns with CWE-284: Improper Access Control, where access decisions rely on the client rather than the server.

Attack Vector

Exploitation requires network access to the Devolutions Server web interface and valid credentials for any low-privileged account. The attacker authenticates and sends a crafted import request to the vault import handler. The server accepts the request and creates the vault without verifying administrative privilege. No user interaction is required beyond the attacker's own session. Refer to the Devolutions Security Advisory DEVO-2026-0013 for technical specifics.

Detection Methods for CVE-2026-9223

Indicators of Compromise

Unexpected vault creation events authored by non-administrative accounts in Devolutions Server audit logs
HTTP requests to the vault import endpoint originating from accounts that lack the vault administrator role
New vaults appearing in the tenant outside change management windows

Detection Strategies

Correlate Devolutions Server audit log entries for vault creation against the role assignments of the calling user
Alert on import API calls where the source account has no historical vault management activity
Baseline normal vault creation cadence per administrator and flag deviations

Monitoring Recommendations

Forward Devolutions Server application and audit logs to a centralized SIEM for retention and correlation
Enable detailed request logging on the reverse proxy fronting Devolutions Server to capture import endpoint usage
Review vault inventory weekly and reconcile against approved provisioning tickets

How to Mitigate CVE-2026-9223

Immediate Actions Required

Upgrade Devolutions Server to a release later than 2026.1.16.0 as published in advisory DEVO-2026-0013
Audit existing vaults and remove any created by accounts without administrative authorization
Review and reduce the population of authenticated accounts that can reach the server interface

Patch Information

Devolutions released a fixed build addressing the missing authorization check in the vault import feature. Administrators should consult the Devolutions Security Advisory DEVO-2026-0013 for the specific fixed version and upgrade procedure. Apply the update on all Devolutions Server instances, including staging and disaster recovery nodes.

Workarounds

Restrict network access to the Devolutions Server web interface to administrative networks until the patch is applied
Temporarily disable or suspend low-privileged accounts that do not require active access during the remediation window
Increase audit log review frequency for vault creation events until the upgrade is complete

bash

# Verify the installed Devolutions Server version after patching
# Compare the reported version against the fixed release in DEVO-2026-0013
curl -s https://<devolutions-server>/api/server/info \
  -H "Authorization: Bearer <admin-token>" | jq '.version'