CVE-2026-8477
LowCVSS 2.7Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request. This affects versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier.
Risk Assessment
The organization is at risk of unauthorized access to sensitive data stored in sealed entries without audit logging, potentially leading to confidentiality breaches and compliance issues.
Recommendation
Update Devolutions Server to a version later than 2026.1.16.0 or apply the appropriate patch provided by the vendor.
Original NVD description (English source)
Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier