This vulnerability (CVE-2026-15637) involves improper authorization in Devolutions Server's PAM SSH key and certificate retrieval endpoints. An authenticated user with low privileges can exploit a direct object reference flaw (CWE-639) to access private SSH keys or certificate credentials that should be restricted. The vulnerability allows unauthorized disclosure of sensitive private key material, potentially compromising secure access mechanisms. The CVSS v3.1 base score is 7.5, indicating high severity. No patch or official remediation level has been published by the vendor as of the data provided.

An attacker with valid low-privileged authentication can retrieve private SSH keys or certificate credentials from the server, potentially leading to unauthorized access to systems that trust these credentials. The confidentiality of critical authentication material is compromised, but integrity and availability are not impacted according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the PAM SSH key and certificate retrieval endpoints to trusted users only and monitor for suspicious access patterns related to credential identifiers.