Dashboard / CVE-2026-110287

CVE-2026-110287

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 59/100
Published: 2026-10-16 Modified: 2026-10-23 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: None
I: Low
A: None

Description

Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
devolutions devolutions_server < 2026.2.20.0

References & Advisories (1)

Bug Bounty Relevance

59 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

4.3 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploitation Probability

0.18%
Raw Score 0.001850
Percentile 8.1%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00185
2026-10-28
0.00185

Intelligence Sources

nvd ref →

External Links