CVE-2026-100288

Executive Summary

CVE-2026-100288 is a cleartext storage of sensitive information vulnerability (CWE-312) in Devolutions Server 2026.3.5.0 and earlier. An attacker with read access to the underlying database can extract external identity provider (IdP) tokens and active session identifiers by directly inspecting stored records. Organizations running affected Devolutions Server versions and whose database may be accessed by unauthorized or over-privileged parties are at risk of credential and session compromise, potentially enabling account takeover and lateral movement within managed environments.

Technical Analysis

The vulnerability stems from the storage of sensitive data — specifically external identity provider tokens and active session identifiers — in cleartext within the Devolutions Server database. CWE-312 (Cleartext Storage of Sensitive Information) applies when an application saves sensitive data without encryption or hashing, leaving it readable to anyone who obtains database access. In this case, the affected data includes tokens issued by external identity providers and identifiers associated with active user sessions.

Because the data is stored in cleartext, no cryptographic exploitation is required: an attacker who can read the relevant database tables or records can directly observe and copy the token and session values. The flaw does not, based on the available description, involve a remotely reachable application endpoint or injection vector; the exposure is a consequence of storage design, and exploitation depends on the attacker obtaining read access to the database through some other means (for example, compromised database credentials, misconfigured access controls, SQL injection in a separate component, or access to a database backup).

Devolutions Server functions as a privileged access management platform, and the stored tokens and session identifiers are associated with authentication flows involving external identity providers. A cleartext representation of these values removes an important defense-in-depth layer: even if an attacker gains database read access, properly protected secrets would normally be encrypted or hashed so that raw values remain unusable. Here, no such protection appears to be applied to the identified fields.

The CVSS v3.1 vector is provided as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N in the metadata above, but the authoritative CVSS score for this CVE is not available (NVD lists N/A). The vector reflects a network-accessible attack with low complexity and low privileges, requiring no user interaction, with high confidentiality impact and no integrity or availability impact. Because the actual score is unscored, consumers should treat this as provisional and consult the vendor or NVD for updated scoring.

The exact database schema, table names, column names, and encryption routines are not described in the available NVD description and are therefore not specified here. No public proof-of-concept, exploit code, or Nuclei template has been identified.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (CWE-312, cleartext storage) and the NVD description.

1. Reconnaissance / target identification: The attacker identifies a Devolutions Server 2026.3.5.0 or earlier instance and determines whether they can obtain read access to its backing database. This could involve reconnaissance of exposed database services, harvesting database credentials from configuration files or other compromised systems, or leveraging a separate vulnerability that grants database read access. Externally, the Devolutions Server web interface may be fingerprinted, but the vulnerability itself is not triggered through the web front end.

2. Triggering the flaw class: Once read access to the database is obtained, the attacker inspects stored records. Because external identity provider tokens and active session identifiers are stored in cleartext, the attacker does not need to defeat any encryption — the sensitive values are directly readable. No specific table or column names are provided in the advisory, so the attacker would enumerate database contents to locate the relevant records.

3. Extraction: The attacker copies the cleartext external identity provider tokens and active session identifiers from the database. Depending on the token type and session model, these values may be usable directly to authenticate to external identity providers or to impersonate active sessions within Devolutions Server or integrated systems.

4. Post-exploitation impact: Possession of valid external IdP tokens and active session identifiers can enable account takeover, session hijacking, and access to resources protected by the affected identity flows. In a privileged access management context, this may allow the attacker to reach further managed systems, escalate privileges, or maintain persistence by reusing harvested tokens. Integrity and availability are not directly affected by the flaw itself, but downstream effects are possible if the stolen credentials grant write or administrative access.

Impact Assessment

The primary impact is confidentiality: an attacker with database read access can obtain external identity provider tokens and active session identifiers. In a privileged access management product such as Devolutions Server, these secrets are high value because they can bridge into external identity systems and active user sessions. The blast radius includes any user or service whose IdP token or session is stored in the affected database; compromise of a session identifier can enable impersonation without knowledge of the user's password or MFA, depending on the session model.

Business impact includes potential unauthorized access to managed systems and sensitive credentials, regulatory and compliance exposure where cleartext storage of authentication secrets violates data protection requirements, and incident response costs associated with token and session revocation. The attack requires the attacker to already possess read access to the database (low privileges, network positioned), so it is not a standalone remote code execution issue — it is an amplifier that converts database read access into credential and session compromise.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates high confidentiality impact with no integrity or availability impact, low privileges required, network attack vector, and no user interaction. The official CVSS score is not available from NVD, and no EPSS score has been published by FIRST.org at the time of writing. CISA KEV status: not listed.

Detection Guidance

Detection focuses on monitoring database access patterns and the use of harvested credentials. Because no exploitation has been observed publicly, rules below target anomalous database reads and suspicious authentication activity tied to Devolutions Server.

Sigma Rule

title: Potential Devolutions Server Database Cleartext Secret Access
id: 6b3f9c2a-1d4e-4a7b-9c0f-2e8b5a7d1f34
status: experimental
description: Detects unusual read access to the Devolutions Server database that may indicate extraction of cleartext IdP tokens or session identifiers (CVE-2026-100288)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-100288
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: database
  product: mssql
detection:
  selection:
    EventID:
      - 33205
    statement|contains:
      - 'SELECT'
  filter_trusted:
    user|contains:
      - 'svc_devolutions'
      - 'devolutions_service'
  timeframe: 5m
  condition: selection and not filter_trusted
falsepositives:
  - Legitimate administrative database maintenance
level: medium
tags:
  - attack.credential_access
  - attack.t1552.001
  - cve.2026.100288

YARA Rule

rule CVE_2026_100288_Devolutions_Cleartext_Secrets
{
    meta:
        description = "Detects database exports or dumps potentially containing cleartext Devolutions Server IdP tokens and session identifiers"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-100288"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "Devolutions" ascii nocase
        $s2 = "IdentityProvider" ascii nocase
        $s3 = "SessionId" ascii nocase
        $s4 = "AccessToken" ascii nocase
        $s5 = "RefreshToken" ascii nocase

    condition:
        uint32(0) == 0x04034b50 or
        (2 of ($s*))
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $HOME_NET 1433 (msg:"CVE-2026-100288 Possible Devolutions Server Database Cleartext Secret Extraction"; flow:established,to_server; content:"SELECT"; nocase; content:"|22|Session|22|"; nocase; content:"|22|Token|22|"; nocase; within:200; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-recon; sid:2026100288; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where event.type == "start" and process.name in ("sqlcmd", "bcp") and process.command_line : "*Devolutions*"]
  [network where destination.port == 1433 and event.action == "connection_attempted"]

Splunk SPL Query

index=devolutions sourcetype=devolutions:server
| search (query="*SELECT*" OR query="*Session*" OR query="*Token*")
| stats count values(query) as queries by src_user, src_ip
| where count > 10
| sort - count

Wazuh OSSEC Rule

<group name="devolutions,cve-2026-100288,">
  <rule id="100288" level="8">
    <decoded_as>json</decoded_as>
    <field name="event_type">database_query</field>
    <field name="query">\.*(SELECT).*(Session|Token).*</field>
    <description>CVE-2026-100288: Possible cleartext IdP token or session identifier access in Devolutions Server database</description>
    <mitre>
      <id>T1552.001</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, patched version, or workaround is available from the tracked sources.

1. Immediate mitigations:

• Restrict database read access to the minimum set of service accounts and administrators required to operate Devolutions Server; enforce least privilege and strong authentication for database accounts.
• Audit and revoke over-privileged database roles and eliminate shared database credentials.
• Review database backups and exported data for exposure; ensure backup media and files are encrypted at rest.
• Where supported, enable transparent database encryption and/or storage encryption so that data at rest is protected even if records are read in cleartext by the application.
• Monitor and rotate external identity provider tokens and active sessions proactively.
• Segment the database network so that only Devolutions Server components can reach it, reducing the likelihood of an attacker obtaining read access.

2. Patch/upgrade steps:

• There is currently no patch evidence from any tracked source. Monitor Devolutions' official advisories and NVD for a fixed version, and upgrade to a patched release as soon as one is published.
• Until a patch is available, treat the database as a high-value secret store and apply compensating controls described above.

3. Long-term hardening:

• Require encryption or hashing of sensitive tokens and session identifiers at rest as part of secure storage design (address CWE-312 systematically).
• Establish a secrets-management program covering application databases and privileged access management platforms.
• Implement database activity monitoring (DAM) and alerting on unusual read patterns against authentication/session tables.
• Conduct regular reviews of third-party and integrated identity provider token lifetimes and revocation capabilities.
• Prepare an incident response playbook for credential/session compromise that includes mass token revocation and session invalidation procedures.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-100288
• CWE-312: Cleartext Storage of Sensitive Information — https://cwe.mitre.org/data/definitions/312.html
• Devolutions Server product/security advisories (vendor site) — consult the official Devolutions security advisory page for CVE-2026-100288 updates
• MITRE ATT&CK T1552.001 — Unsecured Credentials: Credentials In Files — https://attack.mitre.org/techniques/T1552/001/
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-100288 not currently listed)

No exploit-in-the-wild evidence, public proof-of-concept, or threat actor campaign has been identified for this CVE in the data provided.