The vulnerability identified as CVE-2026-15642 involves the unintended inclusion of sensitive data, namely the Azure Key Vault client secret, in the Recovery Kit response file generated by Devolutions Server versions 2026.1.22.0 and 2026.2.11.0. An attacker who gains access to this response file can retrieve the client secret in cleartext, potentially compromising the security of Azure Key Vault integrations. The issue persists despite the user selecting the option to exclude sensitive data from the response file. The affected product is a cloud service, which implies that remediation is managed by the vendor.

An attacker with access to the generated Recovery Kit response file can obtain the Azure Key Vault client secret in cleartext. This exposure of sensitive credentials can lead to unauthorized access to Azure Key Vault resources, potentially compromising stored secrets and impacting confidentiality. The vulnerability undermines the security controls intended to protect sensitive information within the response file generation process.

Since Devolutions Server is a cloud-hosted service, the vendor manages remediation server-side. A patch is available for this vulnerability. Users should monitor vendor communications and apply updates as provided. No additional user action is required to mitigate this vulnerability beyond ensuring the service is updated according to vendor guidance.