CVE-2026-15637

—

CVSS 3.1

7.5 high

EPSS

<1%p17

Published

Jul 14, 2026 (Jul 14, 2026)

Modified

Jul 30, 2026

Description

Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.

Vendors: devolutions
Products: devolutions server
Weakness: CWE-639
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news0 stories

No ingested article mentions this CVE yet.