An authenticated non‑administrator can delete network discovery scan configurations because the PAM account discovery feature in Devolutions Server lacks proper access control. Removing these configurations disables the server’s ability to automatically identify and inventory devices on the network, thus disrupting visibility. The vulnerability does not grant remote code execution or elevate privileges beyond the existing non‑admin credentials.

Devolutions Server version 2026.1.19 and all earlier releases are affected. The impact applies across all deployments of that software family.

The exploit requires valid non‑administrator credentials; no additional conditions such as network access or elevation are mentioned. The CVSS score of 5.4 indicates moderate severity, the EPSS score is unavailable, and the vulnerability is not listed in CISA KEV, so the overall risk cannot be quantified precisely. Nonetheless, the loss of network discovery capability can affect operational monitoring and inventory processes for systems that rely on the server.