CVE-2026-10786NVD

Vulnerability Summary

Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request.

This issue affects :

* Devolutions Server 2026.2.4.0
* Devolutions Server 2026.1.20.0 and earlier

Severity Level

MEDIUM(6.5)

Published Date

Jun 8, 2026

Last Modified

Jun 12, 2026

Exploitation Status

????

EPSS Score (30-Day)

0.02%Probability

Root Weakness (CWE)

CWE-312: Unknown/Unlisted Weakness ↗

Refer to the official MITRE database for detailed architectural specifications regarding this weakness.

CVSS v3.1 Base Metrics

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredLow

User InteractionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityNone

AvailabilityNone

External References

https://devolutions.net/security/advisories/DEVO-2026-0015/

Critical Alert 1 Active Exploit Detected Today

CVE Watchtower

CVE-2026-10786NVD

Vulnerability Summary

External References