IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-07-14 19:16

MODIFIED

2026-07-14 19:16

EPSS (Prob. Exploit)

0.15%

Top 95.9%

DATA SOURCES:

NVD 🔗 2026-07-14 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-10-25

> DESCRIPTION

Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-200

> CWE DETAILED DESCRIPTIONS

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

> HISTORIQUE DES MODIFICATIONS

Première apparition

14/07/2026 19:16

Source: NVD

📊 ENRICHISSEMENT 01/08/2026 06:01

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Total des modifications: 1 Dernière mise à jour: 3 months ago

> REFERENCES

https://devolutions.net/security/advisories/DEVO-2026-0024/