Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 HIGH SEVERITY: CVE-2026-15637 (CVSS 7.5) Devolutions Server 2026.2.11 & 2026.1.22 - Improper authorization allows low-priv users to steal PAM SSH private keys via direct object reference. Patch immediately. #CVE #PatchNow https://t.co/Cb0A9inZdW
Post summary
The tweet alerts to a high‑severity CVE‑2026‑15637 that allows low‑privileged users to steal PAM SSH keys in Devolutions Server, urging users to apply the patch immediately.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | devolutions | devolutions_server | - | - | - |