CVE-2026-8477

LowCVSS 2.7/10Last modified Jul 23, 2026

Description

Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request.

This issue affects :

* Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier

Metrics

CVSS 3.1 2.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-841

Affected software

No affected versions have been published.

Timeline

Published
May 22, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-847708.8Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions.CVE-2026-847715.3Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions.CVE-2026-847725.5Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions.CVE-2026-847737.2Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.CVE-2026-847746.1Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.CVE-2026-847755.3Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions.CVE-2026-847767.5Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.CVE-2026-847777.4Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions.CVE-2026-847787.5Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration &amp; Cloning <= 6.65 versions.CVE-2026-847798.1Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 versions.CVE-2026-84788.8IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of uCVE-2026-847805.3Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions.
CVE-2026-8477: Low severity, CVSS 2.7 | Vulnix