The vulnerability stems from insufficient logging in the entry export feature of Devolutions Server. An authenticated user with export permissions can craft a request that exports a sealed entry without triggering the unseal notification that is normally sent to administrators. This flaw enables an insider or compromised account to disclose sensitive credential information while remaining undetected by administrative monitoring systems, thereby compromising confidentiality. The weakness falls under CWE‑778: Insufficient Logging or Monitoring.

The affected product is Devolutions Server. Vulnerable versions include 2026.1.6.0 through 2026.1.16.0 as well as all releases 2025.3.20.0 or earlier.

The risk is that privileged users could exfiltrate sealed credentials without triggering audit alerts. The CVSS score is 2.4, the EPSS score is not available, and the vulnerability is not listed in CISA KEV, indicating that publicly available exploits have not been identified. Attackers would need legitimate export permissions; the vector is internal, but the impact on data confidentiality remains high. Due to the lack of public exploits and the requirement for specific permissions, the likelihood of exploitation is uncertain but could be significant in environments where export rights are improperly assigned.