Server (Devolutions) - vulnerabilities (CVEs)

106 CVEs, 16 in the last 30 days, 3 known versions, newest CVE from 2026-10-22. Vendor: Devolutions.

CVEs of Server

CVE-2026-114487, 2026-10-22: Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an…
CVE-2026-114486, 2026-10-22: Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative…
CVE-2026-114485, 2026-10-22: Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker…
CVE-2026-110805 - CVSS 2.6 (low), 2026-10-16: Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate…
CVE-2026-110804 - CVSS 4.3 (medium), 2026-10-16: Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with…
CVE-2026-110806 - CVSS 6.5 (medium), 2026-10-16: Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain…
CVE-2026-110287 - CVSS 4.3 (medium), 2026-10-16: Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit…
CVE-2026-105488 - CVSS 7.1 (high), 2026-10-06: Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission…
CVE-2026-105485 - CVSS 6.8 (medium), 2026-10-06: Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via…
CVE-2026-9226 - CVSS 6.8 (medium), 2026-10-06: Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account…
CVE-2026-100289 - CVSS 5 (medium), 2026-09-29: Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to…
CVE-2026-100288 - CVSS 7.2 (high), 2026-09-29: Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to…
CVE-2026-100287 - CVSS 5.4 (medium), 2026-09-29: Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently…
CVE-2026-100286 - CVSS 6.5 (medium), 2026-09-29: Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose…
CVE-2026-93332 - CVSS 5.4 (medium), 2026-09-29: Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read,…
CVE-2026-93330 - CVSS 4.3 (medium), 2026-09-29: Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the…
CVE-2026-13327 - CVSS 8.3 (high), 2026-09-15: Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to…
CVE-2026-84850 - CVSS 4.8 (medium), 2026-09-15: Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows…
CVE-2026-90969 - CVSS 6.5 (medium), 2026-09-15: Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password…
CVE-2026-90971 - CVSS 6.5 (medium), 2026-09-15: Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated…
CVE-2026-17570 - CVSS 4.3 (medium), 2026-07-27: Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext…
CVE-2026-17569 - CVSS 4.3 (medium), 2026-07-27: Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored…
CVE-2026-17568 - CVSS 8.8 (high), 2026-07-27: Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the…
CVE-2026-15058 - CVSS 3.1 (low), 2026-07-14: Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another…
CVE-2026-15642 - CVSS 3.3 (low), 2026-07-14: Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an…
CVE-2026-15641 - CVSS 7.1 (high), 2026-07-14: Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve…
CVE-2026-15637 - CVSS 7.5 (high), 2026-07-14: Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated…
CVE-2026-14536 - CVSS 8.8 (high), 2026-07-06: Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to…
CVE-2026-12755 - CVSS 2.7 (low), 2026-06-25: Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the…
CVE-2026-10787 - CVSS 4.3 (medium), 2026-06-08: Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user…
CVE-2026-10786 - CVSS 6.5 (medium), 2026-06-08: Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext…
CVE-2026-10544 - CVSS 6.5 (medium), 2026-06-08: Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with…
CVE-2026-9590 - CVSS 5.3 (medium), 2026-06-02: Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit…
CVE-2026-9522 - CVSS 5.4 (medium), 2026-06-02: Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative…
CVE-2026-7325 - CVSS 7.1 (high), 2026-05-22: Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication…
CVE-2026-9251 - CVSS 5.4 (medium), 2026-05-22: Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the…
CVE-2026-5171 - CVSS 4.3 (medium), 2026-05-22: Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required…
CVE-2026-8477 - CVSS 2.7 (low), 2026-05-22: Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access…
CVE-2026-9246 - CVSS 4.3 (medium), 2026-05-22: Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to…
CVE-2026-9224 - CVSS 4.3 (medium), 2026-05-22: Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile…
CVE-2026-9249 - CVSS 3.1 (low), 2026-05-22: Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password…
CVE-2026-9245 - CVSS 5 (medium), 2026-05-22: Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to…
CVE-2026-9247 - CVSS 2.4 (low), 2026-05-22: Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without…
CVE-2026-9248 - CVSS 2.6 (low), 2026-05-22: Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation…
CVE-2026-9223 - CVSS 4.3 (medium), 2026-05-22: Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new…
CVE-2026-9047 - CVSS 7.6 (high), 2026-05-22: Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a…
CVE-2026-5146 - CVSS 4.3 (medium), 2026-05-12: Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user…
CVE-2026-8407 - CVSS 4.3 (medium), 2026-05-12: Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP…
CVE-2026-6706 - CVSS 6.5 (medium), 2026-04-28: Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from…
CVE-2026-5175 - CVSS 5 (medium), 2026-04-01: Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own…
CVE-2026-4829 - CVSS 5.4 (medium), 2026-04-01: Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as…
CVE-2026-4927 - CVSS 6.5 (medium), 2026-04-01: Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys…
CVE-2026-4828 - CVSS 8.2 (high), 2026-04-01: Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass…
CVE-2026-4925 - CVSS 5 (medium), 2026-04-01: Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove…
CVE-2026-4924 - CVSS 8.2 (high), 2026-04-01: Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid…
CVE-2026-4989 - CVSS 4.3 (medium), 2026-04-01: Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request…
CVE-2026-4434 - CVSS 8.1 (high), 2026-03-20: Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS…
CVE-2026-3638 - CVSS 5.9 (medium), 2026-03-09: Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to…
CVE-2026-3130 - CVSS 9.8 (critical), 2026-03-03: Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete…
CVE-2026-3224 - CVSS 9.8 (critical), 2026-03-03: Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to…
CVE-2026-3204 - CVSS 9.8 (critical), 2026-03-03: Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message…
CVE-2026-3221 - CVSS 4.9 (medium), 2026-02-25: Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the…
CVE-2026-3131 - CVSS 6.5 (medium), 2026-02-24: Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only…
CVE-2026-1007 - CVSS 7.6 (high), 2026-01-19: Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server:…
CVE-2026-0610 - CVSS 9.8 (critical), 2026-01-19: SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12
CVE-2025-13683 - CVSS 6.5 (medium), 2025-11-28: Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through…
CVE-2025-13758 - CVSS 3.5 (low), 2025-11-27: Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.
CVE-2025-13757 - CVSS 8.8 (high), 2025-11-27: SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.
CVE-2025-13765 - CVSS 4.3 (medium), 2025-11-27: Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21,…
CVE-2025-12485 - CVSS 8.8 (high), 2025-11-06: Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account…
CVE-2025-12808 - CVSS 6.5 (medium), 2025-11-06: Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values,…
CVE-2025-11958 - CVSS 5.1 (medium), 2025-10-22: An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a…
CVE-2025-11957 - CVSS 9 (critical), 2025-10-22: Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or…
CVE-2025-8353 - CVSS 5.9 (medium), 2025-07-30: UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote…
CVE-2025-8312 - CVSS 7.1 (high), 2025-07-30: Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a…
CVE-2025-6741 - CVSS 7.7 (high), 2025-07-22: Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message…
CVE-2025-6523 - CVSS 9.5 (critical), 2025-07-22: Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute…
CVE-2025-5382 - CVSS 6.8 (medium), 2025-06-05: Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change…
CVE-2025-3768 - CVSS 5 (medium), 2025-06-05: Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking…
CVE-2025-0691 - CVSS 5 (medium), 2025-06-05: Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission"…
CVE-2025-4433 - CVSS 8.8 (high), 2025-05-30: Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and…
CVE-2025-4493 - CVSS 6.5 (medium), 2025-05-28: Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorized groups by…
CVE-2025-4316 - CVSS 4.3 (medium), 2025-05-05: Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy…
CVE-2025-2280 - CVSS 8.1 (high), 2025-03-13: Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser…
CVE-2025-2278 - CVSS 6.5 (medium), 2025-03-13: Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user…
CVE-2025-2277 - CVSS 7.5 (high), 2025-03-13: Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH…
CVE-2025-2003 - CVSS 7.1 (high), 2025-03-05: Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.
CVE-2025-1231 - CVSS 5.4 (medium), 2025-02-11: Improper password reset in PAM Module in Devolutions Server 2024.3.10.0 and earlier allows an authenticated user to reuse the oracle user password after…
CVE-2024-12196 - CVSS 6.5 (medium), 2024-12-04: Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of…
CVE-2024-12151 - CVSS 5 (medium), 2024-12-04: Incorrect permission assignment in the user migration feature in Devolutions Server 2024.3.8.0 and earlier allows users to retain their old permission sets.
CVE-2024-12148 - CVSS 4.3 (medium), 2024-12-04: Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting…
CVE-2024-4846 - CVSS 6.3 (medium), 2024-06-25: Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user…
CVE-2024-5072 - CVSS 6.5 (medium), 2024-05-17: Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT…
CVE-2024-3545 - CVSS 4.3 (medium), 2024-04-09: Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server…
CVE-2024-2918 - CVSS 3.6 (low), 2024-04-09: Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation…
CVE-2024-2921 - CVSS 9.8 (critical), 2024-03-26: Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access…
CVE-2024-2915 - CVSS 8.8 (high), 2024-03-26: Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to…
CVE-2024-1898 - CVSS 4.3 (medium), 2024-03-05: Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications…
CVE-2024-1901 - CVSS 4.3 (medium), 2024-03-05: Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM…
CVE-2024-1900 - CVSS 5.5 (medium), 2024-03-05: Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an…