EUVD-2026-116497

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the...

CVE-2026-120716

The Devolutions Server version 2026.3.13.0 and earlier is vulnerable to an insertion of sensitive information into sent data within the identity provider user synchronization. An authenticated user possessing the delegated permission to update users from the identity provider can obtain MFA secre...

EUVD-2026-116494

Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a...

CVE-2026-119636

The Devolutions Server versions 2025.3.2.0 through 2026.2.22.0 are vulnerable to an improper release of expired privileged access checkouts within the PAM scheduled check-in task . An authenticated user with checkout rights can retain access to a PAM account on a target system even after the chec...

CVE-2026-120734

The Devolutions Server (version 2026.3.13.0 and earlier) is vulnerable to the cleartext transmission of sensitive information during the email configuration test . An authenticated user with access to the test action can obtain a stored SMTP password by initiating a request that specifies an atta...

EUVD-2026-116492

Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host...

EUVD-2026-116491

Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request...

CVE-2026-120715

A Server-side request forgery (SSRF) vulnerability exists in the Active Directory credential validation of Devolutions Server version 2026.3.12.0 and earlier. This flaw allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account by providing an attacker-c...

EUVD-2026-116489

Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrato...

CVE-2026-120733

The vulnerability exists in Devolutions Server 2026.3.12.0 and earlier due to the cleartext storage of sensitive information within user account data. Specifically, the application writes an unencrypted copy of the security key when an administrator saves a user. An attacker who gains read access...

CVE-2026-121580

A Server-side request forgery (SSRF) vulnerability exists in the Jira ticketing filter lookup of Devolutions Server version 2026.2.22.0 and earlier . This flaw allows an authenticated low-privileged user to intercept and obtain stored Jira service account credentials by providing an attacker-cont...

EUVD-2026-116217

Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request...

Devolutions Server < 2026.2.21.0 / 2026.3.5.0 < 2026.3.11.0 Multiple Vulnerabilities (DEVO-2026-0037)

The version of Devolutions Server installed on the remote host is prior to 2026.2.21.0, or is 2026.3.5.0 through 2026.3.10.0. It is, therefore, affected by multiple vulnerabilities, including: - Missing authorization in the PAM AD computer import endpoint in Devolutions Server allows an...

Devolutions Server (DVLS) — Bypassable PAM Entitlement Gate Exposes the `test-sc — Detect

Fingerprint / reachability check for Devolutions Server DVLS — Bypassable PAM Entitlement Gate Exposes the test-script PowerShell Sink: Administrator to NT AUTHORITY\SYSTEM !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Devolutions Server DVLS — Bypassable PAM Entitlement Gate Exposes...

Devolutions Server test-script PAM gate bypass RCE

Administrator login then POST /api/pam/provider-templates/test-script with PamSystemVault GUID in query bypasses entitlement gate and runs PowerShell. """Devolutions Server PAM gate bypass + test-script PowerShell SYSTEM RCE.""" from future import annotations import json import re from kittysploi...

CVE-2026-114485

Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to obtain the MFA secrets of all users via the user list API response...

CVE-2026-114486

Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass the Network Access Rules of a virtual gateway and reach denied hosts via wildcard additional destinations signed into the...

CVE-2026-114487

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request...

EUVD-2026-108223

Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing AD providers via a crafted import request...

CVE-2026-114487

The Devolutions Server versions 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier are vulnerable to a missing authorization flaw (CWE-862) in the PAM AD computer import endpoint . This issue allows an authenticated non-administrative user with a PAM license to create PAM sub-providers un...