Devolutions Server (Devolutions) - vulnerabilities (CVEs)

116 CVEs, 4 in the last 30 days, 232 known versions, newest CVE from 2026-10-16. Vendor: Devolutions.

CVEs of Devolutions Server

CVE-2026-110805 - CVSS 2.6 (low), 2026-10-16: Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate…
CVE-2026-110804 - CVSS 4.3 (medium), 2026-10-16: Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with…
CVE-2026-110806 - CVSS 6.5 (medium), 2026-10-16: Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain…
CVE-2026-110287 - CVSS 4.3 (medium), 2026-10-16: Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit…
CVE-2026-17570 - CVSS 4.3 (medium), 2026-07-27: Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext…
CVE-2026-17569 - CVSS 4.3 (medium), 2026-07-27: Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored…
CVE-2026-17568 - CVSS 8.8 (high), 2026-07-27: Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the…
CVE-2026-15058 - CVSS 3.1 (low), 2026-07-14: Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another…
CVE-2026-15642 - CVSS 3.3 (low), 2026-07-14: Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an…
CVE-2026-15641 - CVSS 7.1 (high), 2026-07-14: Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve…
CVE-2026-15637 - CVSS 7.5 (high), 2026-07-14: Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated…
CVE-2026-14536 - CVSS 8.8 (high), 2026-07-06: Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to…
CVE-2026-12755 - CVSS 2.7 (low), 2026-06-25: Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the…
CVE-2026-12105 - CVSS 6.5 (medium), 2026-06-16: Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited…
CVE-2026-11890 - CVSS 4.3 (medium), 2026-06-16: Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery…
CVE-2026-12117 - CVSS 4.3 (medium), 2026-06-16: Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login…
CVE-2026-10786 - CVSS 6.5 (medium), 2026-06-08: Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext…
CVE-2026-10544 - CVSS 6.5 (medium), 2026-06-08: Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with…
CVE-2026-10787 - CVSS 4.3 (medium), 2026-06-08: Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user…
CVE-2026-9590 - CVSS 5.3 (medium), 2026-06-02: Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit…
CVE-2026-9522 - CVSS 5.4 (medium), 2026-06-02: Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative…
CVE-2026-7325 - CVSS 7.1 (high), 2026-05-22: Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication…
CVE-2026-9251 - CVSS 5.4 (medium), 2026-05-22: Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the…
CVE-2026-5171 - CVSS 4.3 (medium), 2026-05-22: Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required…
CVE-2026-8477 - CVSS 2.7 (low), 2026-05-22: Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access…
CVE-2026-9246 - CVSS 4.3 (medium), 2026-05-22: Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to…
CVE-2026-9224 - CVSS 4.3 (medium), 2026-05-22: Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile…
CVE-2026-9249 - CVSS 3.1 (low), 2026-05-22: Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password…
CVE-2026-9245 - CVSS 5 (medium), 2026-05-22: Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to…
CVE-2026-9247 - CVSS 2.4 (low), 2026-05-22: Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without…
CVE-2026-9248 - CVSS 2.6 (low), 2026-05-22: Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation…
CVE-2026-9223 - CVSS 4.3 (medium), 2026-05-22: Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new…
CVE-2026-9047 - CVSS 7.6 (high), 2026-05-22: Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a…
CVE-2026-5146 - CVSS 4.3 (medium), 2026-05-12: Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user…
CVE-2026-8407 - CVSS 4.3 (medium), 2026-05-12: Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP…
CVE-2026-6706 - CVSS 6.5 (medium), 2026-04-28: Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from…
CVE-2026-5175 - CVSS 5 (medium), 2026-04-01: Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own…
CVE-2026-4828 - CVSS 8.2 (high), 2026-04-01: Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass…
CVE-2026-4925 - CVSS 5 (medium), 2026-04-01: Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove…
CVE-2026-4924 - CVSS 8.2 (high), 2026-04-01: Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid…
CVE-2026-4989 - CVSS 4.3 (medium), 2026-04-01: Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request…
CVE-2026-4829 - CVSS 5.4 (medium), 2026-04-01: Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as…
CVE-2026-4927 - CVSS 6.5 (medium), 2026-04-01: Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys…
CVE-2026-4434 - CVSS 8.1 (high), 2026-03-20: Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS…
CVE-2026-3638 - CVSS 5.9 (medium), 2026-03-09: Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to…
CVE-2026-3224 - CVSS 9.8 (critical), 2026-03-03: Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to…
CVE-2026-3204 - CVSS 9.8 (critical), 2026-03-03: Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message…
CVE-2026-3130 - CVSS 9.8 (critical), 2026-03-03: Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete…
CVE-2026-3221 - CVSS 4.9 (medium), 2026-02-25: Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the…
CVE-2026-3131 - CVSS 6.5 (medium), 2026-02-24: Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only…
CVE-2026-1768 - CVSS 4.3 (medium), 2026-02-24: A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects…
CVE-2026-1007 - CVSS 7.6 (high), 2026-01-19: Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server:…
CVE-2026-0610 - CVSS 9.8 (critical), 2026-01-19: SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12
CVE-2025-13683 - CVSS 6.5 (medium), 2025-11-28: Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through…
CVE-2025-13757 - CVSS 8.8 (high), 2025-11-27: SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.
CVE-2025-13765 - CVSS 4.3 (medium), 2025-11-27: Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21,…
CVE-2025-13758 - CVSS 3.5 (low), 2025-11-27: Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.
CVE-2025-12808 - CVSS 6.5 (medium), 2025-11-06: Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values,…
CVE-2025-12485 - CVSS 8.8 (high), 2025-11-06: Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account…
CVE-2025-11958 - CVSS 5.1 (medium), 2025-10-22: An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a…
CVE-2025-11957 - CVSS 9 (critical), 2025-10-22: Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or…
CVE-2025-11619 - CVSS 8.8 (high), 2025-10-15: Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.
CVE-2025-8312 - CVSS 7.1 (high), 2025-07-30: Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a…
CVE-2025-8353 - CVSS 5.9 (medium), 2025-07-30: UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote…
CVE-2025-6741 - CVSS 7.7 (high), 2025-07-22: Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message…
CVE-2025-6523 - CVSS 9.5 (critical), 2025-07-22: Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute…
CVE-2025-5382 - CVSS 6.8 (medium), 2025-06-05: Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change…
CVE-2025-3768 - CVSS 5 (medium), 2025-06-05: Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking…
CVE-2025-0691 - CVSS 5 (medium), 2025-06-05: Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission"…
CVE-2025-4433 - CVSS 8.8 (high), 2025-05-30: Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and…
CVE-2025-4493 - CVSS 6.5 (medium), 2025-05-28: Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorized groups by…
CVE-2025-4316 - CVSS 4.3 (medium), 2025-05-05: Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy…
CVE-2025-3517 - CVSS 6.3 (medium), 2025-05-01: Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured…
CVE-2025-2278 - CVSS 6.5 (medium), 2025-03-13: Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user…
CVE-2025-2277 - CVSS 7.5 (high), 2025-03-13: Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH…
CVE-2025-2280 - CVSS 8.1 (high), 2025-03-13: Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser…
CVE-2025-2003 - CVSS 7.1 (high), 2025-03-05: Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.
CVE-2025-1231 - CVSS 5.4 (medium), 2025-02-11: Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after…
CVE-2024-12196 - CVSS 6.5 (medium), 2024-12-04: Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of…
CVE-2024-12148 - CVSS 4.3 (medium), 2024-12-04: Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting…
CVE-2024-12151 - CVSS 5 (medium), 2024-12-04: Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
CVE-2024-10971 - CVSS 4.3 (medium), 2024-11-12: Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive…
CVE-2024-6512 - CVSS 6.5 (medium), 2024-09-25: Authorization bypass in the PAM access request approval mechanism in Devolutions Server 2024.2.10 and earlier allows authenticated users with permissions to…
CVE-2024-4846 - CVSS 6.3 (medium), 2024-06-25: Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user…
CVE-2024-5072 - CVSS 6.5 (medium), 2024-05-17: Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT…
CVE-2024-3545 - CVSS 4.3 (medium), 2024-04-09: Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server…
CVE-2024-2918 - CVSS 3.6 (low), 2024-04-09: Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation…
CVE-2024-2915 - CVSS 8.8 (high), 2024-03-26: Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to…
CVE-2024-2921 - CVSS 9.8 (critical), 2024-03-26: Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access…
CVE-2024-1898 - CVSS 4.3 (medium), 2024-03-05: Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications…
CVE-2024-1901 - CVSS 4.3 (medium), 2024-03-05: Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM…
CVE-2024-1900 - CVSS 5.5 (medium), 2024-03-05: Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an…
CVE-2024-1764 - CVSS 7.6 (high), 2024-03-05: Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue using the…
CVE-2023-6264 - CVSS 5.3 (medium), 2023-11-22: Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions…
CVE-2023-5358 - CVSS 5.3 (medium), 2023-11-01: Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vaults or entries…
CVE-2023-5575 - CVSS 6.5 (medium), 2023-10-16: Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user…
CVE-2023-5240 - CVSS 7.5 (high), 2023-10-13: Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation…
CVE-2023-2400 - CVSS 2.7 (low), 2023-06-20: Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of…
CVE-2023-2445 - CVSS 4.9 (medium), 2023-05-02: Improper access control in Subscriptions Folder path filter in Devolutions Server 2023.1.1 and earlier allows attackers with administrator privileges to…
CVE-2023-2118 - CVSS 5.4 (medium), 2023-04-21: Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send support tickets and…