Devolutions - vulnerabilities (CVEs)

207 CVEs in 17 products, 17 in the last 30 days, newest from 2026-10-27.

Products

• Devolutions Server - 116 CVEs
• Server - 106 CVEs
• Remote Desktop Manager - 53 CVEs
• Powershell Universal - 14 CVEs
• Workspace - 3 CVEs
• Devolutions Gateway - 1 CVEs
• Dvls Devolutions Server - 1 CVEs
• Gateway - 1 CVEs
• Gfwx - 1 CVEs
• Hub Reporting Service - 1 CVEs
• Password Hub - 1 CVEs
• Password Manager - 1 CVEs
• Remote Desktop Manager Powershell - 1 CVEs
• Remote Desktop Manager Powershell Module - 1 CVEs
• Unigetui - 1 CVEs
• Workspace Desktop - 1 CVEs
• Xts.net - 1 CVEs

Newest CVEs of Devolutions

• CVE-2026-116627, 2026-10-27: Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0…
• CVE-2026-114487, 2026-10-22: Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an…
• CVE-2026-114486, 2026-10-22: Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier allows an authenticated non-administrative…
• CVE-2026-114485, 2026-10-22: Insufficient protection of sensitive information in the user list endpoint in Devolutions Server  2026.3.10.0 and earlier allows an authenticated attacker…
• CVE-2026-110805 - CVSS 2.6 (low), 2026-10-16: Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate…
• CVE-2026-110804 - CVSS 4.3 (medium), 2026-10-16: Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with…
• CVE-2026-110806 - CVSS 6.5 (medium), 2026-10-16: Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain…
• CVE-2026-110287 - CVSS 4.3 (medium), 2026-10-16: Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit…
• CVE-2026-105488 - CVSS 7.1 (high), 2026-10-06: Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission…
• CVE-2026-105485 - CVSS 6.8 (medium), 2026-10-06: Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via…
• CVE-2026-9226 - CVSS 6.8 (medium), 2026-10-06: Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account…
• CVE-2026-100289 - CVSS 5 (medium), 2026-09-29: Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to…
• CVE-2026-100288 - CVSS 7.2 (high), 2026-09-29: Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to…
• CVE-2026-100287 - CVSS 5.4 (medium), 2026-09-29: Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently…
• CVE-2026-100286 - CVSS 6.5 (medium), 2026-09-29: Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose…
• CVE-2026-93332 - CVSS 5.4 (medium), 2026-09-29: Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read,…
• CVE-2026-93330 - CVSS 4.3 (medium), 2026-09-29: Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the…
• CVE-2026-92237 - CVSS 6.5 (medium), 2026-09-15: Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an…
• CVE-2026-13327 - CVSS 8.3 (high), 2026-09-15: Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to…
• CVE-2026-84850 - CVSS 4.8 (medium), 2026-09-15: Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows…
• CVE-2026-90969 - CVSS 6.5 (medium), 2026-09-15: Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password…
• CVE-2026-90971 - CVSS 6.5 (medium), 2026-09-15: Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated…
• CVE-2026-78417 - CVSS 4.3 (medium), 2026-08-24: Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier,…
• CVE-2026-19768 - CVSS 8.1 (high), 2026-08-14: Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an…
• CVE-2026-8497 - CVSS 7.4 (high), 2026-07-29: Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and…
• CVE-2026-17570 - CVSS 4.3 (medium), 2026-07-27: Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext…
• CVE-2026-17569 - CVSS 4.3 (medium), 2026-07-27: Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored…
• CVE-2026-17568 - CVSS 8.8 (high), 2026-07-27: Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the…
• CVE-2026-16802 - CVSS 6.5 (medium), 2026-07-24: Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file…
• CVE-2026-16801 - CVSS 8.8 (high), 2026-07-24: Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an…