EUVD-2026-125777

Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server...

PT-2026-147178

Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server...

EUVD-2026-123815

Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request...

EUVD-2026-123813

Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses...

EUVD-2026-123814

Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response...

EUVD-2026-123812

Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API...

EUVD-2026-123816

Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault...

CVE-2026-126331

Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response...

CVE-2026-126332

Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault...

CVE-2026-126328

Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses...

CVE-2026-126327

Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API...

CVE-2026-126326

Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request...

CVE-2026-126332

Improper access control in the autofill vault search in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only view permission on a shared entry to obtain its password in clear text via a linked credential entry created in their private vault...

CVE-2026-126332

Devolutions Server versions 2026.3.13.0 and earlier are affected by an improper access control vulnerability in the autofill vault search. An authenticated user with only view permission on a shared entry can obtain that entry's password in clear text . This occurs by leveraging a linked credenti...

CVE-2026-126326

An improper access control vulnerability exists in the administrative role assignment endpoint of Devolutions Server versions 2026.3.13.0 and earlier . An authenticated user possessing only vault assignment management rights can perform a crafted role assignment request to escalate privileges and...

CVE-2026-126326

Improper access control in the administrative role assignment endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with only vault assignment management rights to escalate privileges and read vault entry passwords via a crafted role assignment request...

CVE-2026-126331

Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response...

CVE-2026-126331

The Devolutions Server version 2026.3.13.0 and earlier is affected by a vulnerability where the user list endpoint improperly includes sensitive information in its response. This issue allows an authenticated user with delegated user-viewing permissions to retrieve API key secret hashes belonging...

CVE-2026-126328

Insertion of sensitive information into sent data in the user endpoints in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' MFA shared secrets via the user API responses...

CVE-2026-126328

The Devolutions Server versions 2026.3.13.0 and earlier are affected by a vulnerability where sensitive information is inserted into sent data within user endpoints. An authenticated user with delegated user-viewing permissions can exploit this to obtain users' MFA shared secrets through user API...