Vulnerability · Published Jul 27, 2026 · Assigned by DEVOLUTIONS

CVE-2026-17568

High 8.8

In plain English

A high-severity incorrect authorization in Server from Devolutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.4%top 63.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier

Affected products (as reported)

Vendor	Product	Versions
Devolutions	Server	0 – before 2026.1.242026.2.4.0 – before 2026.2.14

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://devolutions.net/security/advisories/DEVO-2026-0026/