CVE-2026-93332

Executive Summary

CVE-2026-93332 is an improper access control vulnerability (CWE-862) in the partial connection API of Devolutions Server versions 2026.3.5.0 and earlier. An authenticated low-privileged user can read, create, modify, and delete System Vault entries by sending a crafted API request, effectively bypassing the authorization model that should restrict System Vault access to administrators. Because the flaw grants full read/write/delete control over sensitive vaulted credentials, the confidentiality and integrity impact on the affected component is high, and the vulnerability is currently unpatched.

Technical Analysis

CVE-2026-93332 resides in the "partial connection API" of Devolutions Server, a privileged access management (PAM) and password-vaulting product. The vulnerability class is CWE-862 ("Missing Authorization"), mapped by NVD under "Improper access control." The weakness means that an authorization check that should gate access to System Vault operations is absent or insufficiently enforced on the partial connection API endpoints.

The critical architectural detail is the distinction between authentication and authorization. The attacker must already be "an authenticated low-privileged user" — i.e., they hold a valid, non-administrative account on the Devolutions Server instance. What is broken is not the authentication step but the authorization step: the server fails to verify whether the calling principal is permitted to perform System Vault operations. Consequently, a request crafted against the partial connection API is processed with the caller's identity but without the required privilege check, allowing the four core vault operations — read, create, modify, and delete — against System Vault entries.

System Vault is a high-value target in a PAM deployment because it typically stores machine/system credentials, service accounts, and infrastructure secrets. The vulnerability thus allows privilege escalation from a low-privileged user to effective control over the secrets that administrators assumed were protected. The attack surface is network-reachable (the product is a server exposing APIs), requires low attack complexity (a crafted API request), requires low privileges (any authenticated account), and requires no user interaction.

Note on scope of evidence: the NVD description does not disclose the specific endpoint path, parameter name, or request structure of the "partial connection API." Those implementation specifics are therefore intentionally not fabricated in this report. All analysis is confined to the observable characteristics stated by the vendor/CNA.

No public proof-of-concept, exploit code, or Nuclei template exists as of this writing. No EPSS score has been published by FIRST.org, and the CVE is not listed in CISA KEV. No CVSS vector was supplied by NVD.

Exploitation Scenarios

Because no public PoC exists, the following chain is inferred strictly from the vulnerability class (missing authorization on an API) and the stated capabilities (read, create, modify, delete System Vault entries).

1. Reconnaissance / target identification: The attacker obtains a valid low-privileged account, either through legitimate provisioning, a phishing operation, credential reuse, or self-registration where enabled. Using Shodan or internal scanning, the attacker identifies reachable Devolutions Server instances. The attacker confirms the target version is 2026.3.5.0 or earlier, since the flaw is version-scoped.

2. Triggering the flaw class: Authenticating with the low-privileged session, the attacker sends a request to the partial connection API. The authorization layer that should verify System Vault privileges is not enforced on this API path, so the request is accepted despite the caller lacking the requisite role. This is the core of CWE-862 — the endpoint relies on the caller being authenticated but never checks whether the caller is authorized to touch System Vault.

3. Payload / execution method (vulnerability-class level): The crafted request is a normal API invocation whose operation targets System Vault entries rather than resources the low-privileged user should be limited to. The specific HTTP method, URL, headers, and body are not disclosed and are not invented here. The attacker iterates the same unguarded path across read, create, modify, and delete operations because the missing check applies to the operation set as a whole.

4. Post-exploitation impact: The attacker reads System Vault secrets (credential theft / lateral movement enablers), creates new entries (persistence, planting rogue credentials), modifies existing entries (tampering — e.g., redirecting stored credentials), and deletes entries (destructive sabotage or covering tracks). Because System Vault holds machine and service credentials, this can cascade into compromise of downstream systems that trust those secrets.

Impact Assessment

CVSS subscores (modeled from the NVD description, since NVD supplied no vector):

• Attack Vector (AV): Network (N) — the partial connection API is remotely reachable.
• Attack Complexity (AC): Low (L) — a crafted API request, no race or special conditions.
• Privileges Required (PR): Low (L) — an authenticated low-privileged account suffices.
• User Interaction (UI): None (N) — no victim action required.
• Scope (S): Unchanged (U) — impact confined to the vulnerable component's security authority.
• Confidentiality (C): High (H) — read access to System Vault secrets.
• Integrity (I): High (H) — create/modify operations allow tampering with stored secrets.
• Availability (A): High (H) — delete operations allow destruction of vault entries.

Business impact: Devolutions Server is a privileged access management system, so its vault is a concentration point of high-value secrets. Successful exploitation undermines the trust boundary that PAM is designed to enforce: low-privileged staff, contractors, or service accounts become able to manipulate the organization's most sensitive credentials. Blast radius extends beyond the vault server itself to every system whose credentials are stored in System Vault. Regulatory exposure is significant because the affected data is credential material (access control failure under frameworks such as SOC 2, ISO 27001, and PCI DSS). The combination of unpatched status, no authentication bypass required, and full CRUD on secrets makes this a high-priority remediation item despite the absence of in-the-wild evidence.

Detection Guidance

Sigma Rule

title: Devolutions Server Partial Connection API System Vault Abuse (CVE-2026-93332)
id: 5b8f2e14-9c3a-4d7e-b1aa-2026cve93332
status: experimental
description: Detects low-privileged users accessing System Vault via the partial connection API, indicating exploitation of CWE-862 improper access control.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-93332
author: valtersit.com
date: 2026/01/01
logsource:
  product: windows
  service: application
detection:
  selection_api:
    EventID: 1
    Image|endswith: '\Devolutions.Server.exe'
  selection_vault:
    Message|contains:
      - 'System Vault'
      - 'partial connection'
  selection_ops:
    Message|contains:
      - 'VaultRead'
      - 'VaultCreate'
      - 'VaultModify'
      - 'VaultDelete'
  condition: selection_api and selection_vault and selection_ops
falsepositives:
  - Legitimate administrative vault operations by privileged accounts
level: high
tags:
  - attack.t1078
  - cve.2026.93332

YARA Rule

rule CVE_2026_93332_Devolutions_Partial_Connection_API
{
    meta:
        description = "Detects indicators of improper access control abuse in Devolutions Server partial connection API (CVE-2026-93332)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-93332"
        date = "2026-01-01"
        severity = "high"
    strings:
        $a = "partial connection" nocase
        $b = "System Vault" nocase
        $c1 = "VaultDelete" nocase
        $c2 = "VaultModify" nocase
        $c3 = "VaultCreate" nocase
    condition:
        uint16(0) == 0x5A4D and $a and $b and any of ($c*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-93332 Devolutions Server Partial Connection API System Vault Access"; flow:established,to_server; http.uri; content:"partial"; nocase; http.uri; content:"connection"; nocase; http.header; content:"Authorization"; nocase; reference:cve,2026-93332; classtype:attempted-user; sid:202693332; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" ]
  [ network where
      url.path : "*partial*" and
      process.name : "Devolutions.Server*" ]

Splunk SPL Query

index=devolutions sourcetype=devolutions:server:api
| where match(lower(_raw), "(?i)partial.*connection")
| where match(lower(_raw), "(?i)system.?vault")
| where match(lower(_raw), "(?i)(vault(read|create|modify|delete))")
| stats count values(user) as users values(src_ip) as source_ips by dest, url_path, action
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="devolutions,cve-2026-93332,">
  <rule id="20269332" level="12">
    <decoded_as>json</decoded_as>
    <field name="product">Devolutions Server</field>
    <match>partial connection</match>
    <match>System Vault</match>
    <description>CVE-2026-93332: Potential improper access control abuse against Devolutions Server System Vault via partial connection API</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>access_control,pam,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). There is currently no vendor-supplied fix or workaround documented in the available intelligence.

1. Immediate mitigations:

   • Restrict network exposure of the Devolutions Server management/API interface to trusted networks and administrative segments; do not expose the partial connection API to general user networks or the internet.
   • Audit and minimize the population of authenticated low-privileged accounts; apply least privilege and remove dormant accounts, since any valid account is a potential exploitation vector.
   • Enable comprehensive logging and monitoring on System Vault operations (read/create/modify/delete) and alert on any non-administrative principal performing them (see Detection Guidance above).
   • Treat System Vault contents as potentially compromised; rotate credentials stored in System Vault if suspicious non-administrative access is observed.
   • Where technically feasible and policy-permitted, temporarily disable or block the partial connection API for non-administrative roles at a reverse proxy/WAF layer, without fabricating specific endpoint paths.

2. Patch/upgrade steps:

   • No patched version is currently identified. Monitor the Devolutions security advisory channel and NVD for a fixed release.
   • Apply the vendor fix as soon as it becomes available; prioritize internet- or broadly reachable instances first.

3. Long-term hardening:

   • Enforce role-based access control review for all vault APIs, verifying that authorization — not merely authentication — is enforced on every endpoint.
   • Implement API authorization testing (negative testing with low-privileged tokens) in CI/CD and periodic penetration testing of PAM products.
   • Adopt a secrets-rotation cadence for System Vault entries and isolate PAM infrastructure from general-purpose user networks.
   • Maintain asset inventory of PAM servers with version tracking to enable rapid response to disclosed CVEs.

References

• NVD — CVE-2026-93332: https://nvd.nist.gov/vuln/detail/CVE-2026-93332
• Devolutions Server security advisories: https://devolutions.net/security/advisories/
• MITRE CWE-862 (Missing Authorization): https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1078 (Valid Accounts): https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-93332 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild status: No known exploitation in the wild, no public PoC, no Nuclei template, and no CISA KEV listing at the time of writing. No named threat actor campaigns are associated with this CVE in available intelligence.