The vulnerability identified as CVE-2026-9522 affects Devolutions Server 2026.1.19 and earlier. It involves improper access control in the PAM account discovery feature, permitting authenticated users lacking administrative privileges to delete network discovery scan configurations. This flaw could allow unauthorized modification of network scanning setups, potentially disrupting network management processes. There is no CVSS score or detailed vendor advisory available, and no known exploits have been reported in the wild. The product is not a cloud service, and no patch or remediation level has been confirmed.

An authenticated user without administrative rights can delete network discovery scan configurations, which may disrupt network discovery operations and affect network management integrity. There is no indication that this vulnerability allows privilege escalation beyond the described scope or remote exploitation. No known exploits are reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to authenticated users who do not require network discovery configuration permissions to minimize risk.