Information Disclosure in Devolutions Server

Executive Summary

This vulnerability involves the insertion of sensitive information into a file generated by the Recovery Kit response file generation feature in Devolutions Server versions 2026.1.22.0 and 2026.2.11.0.

Specifically, the vulnerability allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext. This occurs even when the option to exclude sensitive data is selected, meaning the protection mechanism fails to prevent the exposure of this sensitive information.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking for the presence of generated response files from the Recovery Kit feature in Devolutions Server versions 2026.1.22.0 or 2026.2.11.0. Since the vulnerability involves sensitive information (Azure Key Vault client secret) being inserted into these files, you should inspect any generated response files for cleartext secrets.

• Identify the location where Devolutions Server stores generated response files. This is typically a directory accessible to the application or specified during the Recovery Kit response file generation process.
• Search for response files with commands like: find /path/to/devolutions -name "*.response" -type f to locate potential files.
• Inspect the contents of these files for sensitive information, particularly the Azure Key Vault client secret, using commands like: grep -i "client_secret" /path/to/responsefile.response or cat /path/to/responsefile.response | grep -A 5 -B 5 "secret".

If the option to exclude sensitive data was selected during file generation, verify whether the secret is still present in the file, as this vulnerability bypasses that exclusion.

Useful 0 Not Useful 0

Impact Analysis

If you are using the affected versions of Devolutions Server, this vulnerability could have several impacts:

• An attacker who gains access to the generated response file can extract the Azure Key Vault client secret in cleartext.
• With the Azure Key Vault client secret, the attacker may gain unauthorized access to sensitive data or resources stored in your Azure Key Vault.
• This could lead to further exploitation, such as data breaches, unauthorized modifications, or disruptions to services relying on the Key Vault.
• The exposure of sensitive credentials can also facilitate lateral movement within your network, increasing the risk of broader compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can impact compliance with several common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): Exposure of sensitive information, such as credentials, may lead to unauthorized access to personal data. This could result in a data breach, triggering GDPR's reporting requirements and potential fines for failing to protect personal data adequately.
• HIPAA (Health Insurance Portability and Accountability Act): If the Azure Key Vault stores protected health information (PHI), unauthorized access to this data due to the exposed client secret could violate HIPAA's security and privacy rules, leading to penalties and mandatory corrective actions.
• Other standards like ISO 27001, NIST, or PCI DSS: These frameworks require the protection of sensitive information and credentials. Failure to secure such data could result in non-compliance, audits, or loss of certification.

Organizations must ensure that vulnerabilities exposing sensitive information are promptly addressed to maintain compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these steps immediately:

• Upgrade Devolutions Server to a patched version as soon as it becomes available. Monitor Devolutions' official security advisories or release notes for updates addressing CVE-2026-15642.
• If upgrading is not immediately possible, avoid generating or sharing Recovery Kit response files until a patch is applied. If files must be generated, ensure they are stored securely and access is restricted to authorized personnel only.
• Rotate any exposed Azure Key Vault client secrets or other sensitive credentials that may have been included in the response files. This prevents attackers from using leaked credentials.
• Audit all previously generated response files for sensitive information. Delete or securely archive any files that contain cleartext secrets.
• Restrict access to the Devolutions Server instance and its file storage locations to minimize the risk of unauthorized access to sensitive files.

Useful 0 Not Useful 0