How severe is CVE-2026-10786?

CVE-2026-10786 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2026-10786 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-10786?

CVE-2026-10786 primarily affects Devolutions Devolutions Server. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2026-10786?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-10786 have an EU (EUVD) identifier?

Yes. CVE-2026-10786 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35182.

When was CVE-2026-10786 published?

CVE-2026-10786 was published on 2026-06-08 and last updated on 2026-06-17.

CVE-2026-10786

CVE-2026-10786 is a medium-severity vulnerability in Devolutions Devolutions Server with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-312.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 0% (4th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-35182
Weakness: CWE-312
Affected product: Devolutions Devolutions Server
Published: 2026-06-08
Last modified: 2026-06-17

Description

Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

Frequently asked questions

What is CVE-2026-10786?: Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
How severe is CVE-2026-10786?: CVE-2026-10786 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2026-10786 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-10786?: CVE-2026-10786 primarily affects Devolutions Devolutions Server. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-10786?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-10786 have an EU (EUVD) identifier?: Yes. CVE-2026-10786 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-35182.
When was CVE-2026-10786 published?: CVE-2026-10786 was published on 2026-06-08 and last updated on 2026-06-17.

References

https://devolutions.net/security/advisories/DEVO-2026-0015/

Affected products (2)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*
cpe:2.3:a:devolutions:devolutions_server:2026.2.4.0:*:*:*:*:*:*:*

More vulnerabilities in Devolutions Devolutions Server

CVE-2026-3224 — Critical (CVSS 9.8): Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and…
CVE-2026-3204 — Critical (CVSS 9.8): Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote…
CVE-2026-3130 — Critical (CVSS 9.8): Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated…
CVE-2026-0610 — Critical (CVSS 9.8): SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1…
CVE-2024-2921 — Critical (CVSS 9.8): Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated…
CVE-2021-23921 — Critical (CVSS 9.1): An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry…

All CVEs affecting Devolutions Devolutions Server →

Other CWE-312 (Cleartext Storage of Sensitive Information) vulnerabilities

CVE-2022-43757 — Critical (CVSS 9.9): A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain…
CVE-2021-36782 — Critical (CVSS 9.9): A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster…
CVE-2020-9045 — Critical (CVSS 9.9): During installation or upgrade to Software House C•CURE 9000 v2.70 and American Dynamics victor Video Management…
CVE-2026-31848 — Critical (CVSS 9.8): Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 uses the ecos_pw cookie for authentication, which…
CVE-2025-65826 — Critical (CVSS 9.8): The mobile application was found to contain stored credentials for the network it was developed on. If an attacker…
CVE-2025-34206 — Critical (CVSS 9.8): Vasion Print (formerly PrinterLogic) Virtual Appliance Host and Application (VA and SaaS deployments) mount host…

Browse all CWE-312 (Cleartext Storage of Sensitive Information) vulnerabilities →