CVE-2026-3204

Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - security@devolutions.net

Published

2026-03-03

Last modified

2026-03-04

Weaknesses

CWE-20

Affected products

• Devolutions Server (Devolutions)
• Server (Devolutions)

References

• https://devolutions.net/security/advisories/DEVO-2026-0005