CVE-2026-5175

An improper access control vulnerability exists in the multi-factor authentication (MFA) management API of Devolutions Server (versions 2026.1.6 through 2026.1.11 ). This flaw allows an authenticated attacker to send crafted HTTP requests to delete their own configured MFA factors, effectively re...

CVE-2026-9522

Devolutions Server versions 2026.1.19 and earlier are vulnerable to improper access control within the PAM account discovery feature. This security flaw allows an authenticated user who lacks administrative privileges to delete network discovery scan configurations . To mitigate this issue, users...

CVE-2025-12485

A vulnerability in Devolutions Server (versions 2025.3.2.0 through 2025.3.5.0 and 2025.2.15.0 and earlier) allows a low-privileged authenticated user to impersonate another account. The root cause is improper privilege management during the handling of pre-MFA cookies , which can be replayed by a...

CVE-2025-11619

Devolutions Server, a security solution for managing privileged accounts and sessions, is vulnerable to improper certificate validation when connecting to gateways. This flaw affects versions 2025.3.2 and earlier (specifically prior to 2025.3.3). An attacker positioned in a Man-in-the-Middle (Mit...

CVE-2026-11890

The Devolutions Server versions 2026.1.21 and 2026.2.5 are affected by a vulnerability involving improper access control in the PAM account discovery component. This flaw allows an authenticated user to retrieve account discovery scan results. While the vulnerability is confirmed in these specifi...

CVE-2026-17570

Devolutions Server is impacted by CVE-2026-17570 , a vulnerability caused by improper access control in the PAM password history endpoints . This flaw allows an authenticated low-privileged user to disclose plaintext credential secrets by sending crafted API requests. The issue affects Devolution...

CVE-2025-12808

Devolutions Server is affected by a vulnerability where improper access control allows a View-only user to retrieve sensitive third-level nested fields , such as custom values within password lists. This flaw can lead to password disclosure . The issue impacts Devolutions Server versions 2025.3.2...

CVE-2026-3204

Devolutions Server versions 2025.3.16 and earlier are vulnerable to improper input validation in the error message page. A remote attacker can exploit this flaw by using a specially crafted URL to spoof the displayed error message. To mitigate this risk, it is recommended to update Devolutions Se...

CVE-2026-4927

Devolutions Server versions 2026.1.6 through 2026.1.11 are vulnerable to an information disclosure flaw in the multi-factor authentication (MFA) feature. The root cause is the exposure of sensitive information during the processing of authenticated API requests. This allows users possessing user ...

CVE-2026-4989

Improper input validation in the gateway health check feature of Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF) . By sending a crafted API request, an attacker can potentially cause information disclosure . This vulnerability affects De...

CVE-2026-6706

Improper access control in the vault documentation feature of Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults by sending a crafted API request. This vulnerability affects versions 2026.1.6.0 through 2026.1.14.0 , as well as versions throu...

CVE-2026-4925

An improper access control vulnerability exists in the users MFA feature of Devolutions Server , affecting versions 2026.1.6 through 2026.1.11 . This flaw allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuratio...