Is CVE-2026-9047 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9047 being exploited in the wild.

How severe is CVE-2026-9047?

High severity, with a CVSS score of 7.6, published 22 May 2026.

Which products and versions are affected?

Devolutions Server 2026.1.6.0 through 2026.1.16.0.

Is there a fix for CVE-2026-9047?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-9047 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-9047?

Check whether you run Devolutions Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9047: Devolutions Server MFA bypass in factor management feature

CVE-2026-9047 · Severity: high · CVSS 7.6 · Published 2026-05-22

Devolutions Server, a platform for managing remote connections and privileged access, contains a security flaw in its multi-factor authentication (MFA) system. If an attacker already knows a user's password, they can bypass the secondary security layer (MFA) after that user reconfigures their authentication settings. This could lead to unauthorized access to sensitive corporate credentials and remote systems managed by the server.

Technologies: Devolutions Server. Vendors: Devolutions.

Quick answers

Is CVE-2026-9047 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9047 being exploited in the wild.
How severe is CVE-2026-9047?: High severity, with a CVSS score of 7.6, published 22 May 2026.
Which products and versions are affected?: Devolutions Server 2026.1.6.0 through 2026.1.16.0.
Is there a fix for CVE-2026-9047?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-9047 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-9047?: Check whether you run Devolutions Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An authentication bypass vulnerability (CWE-305) exists in Devolutions Server due to improper handling of factor key states within the MFA management feature. The vulnerability is triggered when a user reconfigures their multi-factor authentication settings, at which point the system fails to correctly validate or invalidate the state of authentication keys. An attacker who has already obtained a target user's primary password can exploit this flaw over the network to bypass MFA requirements. This issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0. Users are advised to upgrade to version 2026.1.19.0 or higher to remediate the risk.

Affected products

Devolutions Server 2026.1.6.0 through 2026.1.16.0

Timeline

2026-05-21: advisory: Initial publication of DEVO-2026-0013 by Devolutions
2026-05-22: disclosed: CVE-2026-9047 published to NVD

References

https://devolutions.net/security/advisories/DEVO-2026-0013/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.