CVE-2026-11890

The Devolutions Server versions 2026.1.21 and 2026.2.5 are affected by a vulnerability involving improper access control in the PAM account discovery component. This flaw allows an authenticated user to retrieve account discovery scan results. While the vulnerability is confirmed in these specifi...

CVE-2026-15058

An improper authorization vulnerability exists in the secure messages deletion endpoint of Devolutions Server versions 2026.2.11 and 2026.1.22 . This flaw allows an authenticated user to delete messages belonging to another user by using a direct object reference to the message identifier. Exploi...

CVE-2025-6523

CVE-2025-6523 affects Devolutions Server, where the emergency authentication component allows unauthenticated bypass via brute-forcing short emergency codes. Affected are Devolutions Server 2025.2.2.0–2025.2.3.0 and 2025.1.11.0 and earlier. Root cause is use of weak credentials in the emergency a...

CVE-2025-12808

Devolutions Server is affected by a vulnerability where improper access control allows a View-only user to retrieve sensitive third-level nested fields , such as custom values within password lists. This flaw can lead to password disclosure . The issue impacts Devolutions Server versions 2025.3.2...

CVE-2026-4829

Devolutions Server versions 2026.1.11 and earlier are vulnerable to an improper authentication flaw in the external OAuth authentication flow. The root cause is the reuse of a session code from an external authentication flow, which allows an authenticated user to bypass security controls and aut...

CVE-2026-4927

Devolutions Server versions 2026.1.6 through 2026.1.11 are vulnerable to an information disclosure flaw in the multi-factor authentication (MFA) feature. The root cause is the exposure of sensitive information during the processing of authenticated API requests. This allows users possessing user ...

CVE-2026-17570

Devolutions Server is impacted by CVE-2026-17570 , a vulnerability caused by improper access control in the PAM password history endpoints . This flaw allows an authenticated low-privileged user to disclose plaintext credential secrets by sending crafted API requests. The issue affects Devolution...

CVE-2026-4989

Improper input validation in the gateway health check feature of Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF) . By sending a crafted API request, an attacker can potentially cause information disclosure . This vulnerability affects De...

CVE-2026-6706

Improper access control in the vault documentation feature of Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults by sending a crafted API request. This vulnerability affects versions 2026.1.6.0 through 2026.1.14.0 , as well as versions throu...

CVE-2026-9522

Devolutions Server versions 2026.1.19 and earlier are vulnerable to improper access control within the PAM account discovery feature. This security flaw allows an authenticated user who lacks administrative privileges to delete network discovery scan configurations . To mitigate this issue, users...

CVE-2025-11619

Devolutions Server, a security solution for managing privileged accounts and sessions, is vulnerable to improper certificate validation when connecting to gateways. This flaw affects versions 2025.3.2 and earlier (specifically prior to 2025.3.3). An attacker positioned in a Man-in-the-Middle (Mit...

CVE-2026-4925

An improper access control vulnerability exists in the users MFA feature of Devolutions Server , affecting versions 2026.1.6 through 2026.1.11 . This flaw allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuratio...

CVE-2026-110805

A Server-side request forgery (SSRF) vulnerability exists in the PingOne groups endpoint of Devolutions Server versions 2026.3.8.0 and earlier . This flaw allows an authenticated low-privileged user to exfiltrate stored PingOne application secrets by providing an attacker-controlled PingOne confi...

CVE-2026-110806

The Devolutions Server versions 2026.3.8.0 and earlier are affected by an incorrect authorization vulnerability in the add-on properties. This flaw allows an authenticated user with only View permission to obtain add-on passwords by accessing unredacted add-on properties returned in connection da...

CVE-2026-110804

The Devolutions Server version 2026.3.8.0 and earlier is vulnerable to an improper modification of JIT elevation settings within the PAM checkout component. This flaw allows an authenticated user with PAM checkout access to either delete arbitrary Active Directory groups or retain elevated privil...

CVE-2026-110287

An improper access control vulnerability in Devolutions Server 2026.3.8.0 and earlier versions allows an authenticated user with general Edit privileges, but lacking specific Edit asset permissions, to modify the asset contact password . This is achievable by sending a crafted direct request to t...