CVE-2026-5171

Devolutions Server is affected by an improper access control vulnerability in its entry activity log feature. An authenticated user who has access to an entry, but lacks the specific required permission, can retrieve that entry's activity logs by sending a crafted API request . This issue impacts...

CVE-2026-7325

Devolutions Server is affected by an improper authorization vulnerability in its Active Directory browsing feature. This flaw allows a low-privileged authenticated user to obtain authentication material associated with a stored PAM provider service account by performing an authentication relay to...

CVE-2026-10544

The Devolutions Server software is vulnerable to an OS command injection flaw due to the improper neutralization of special elements in the built-in PAM provider password rotation templates . This vulnerability allows an authenticated user with write access to a vault to execute arbitrary command...

CVE-2026-9224

Devolutions Server is affected by a missing authorization vulnerability in its user profile update feature . This flaw allows an authenticated Active Directory user to modify their own profile attributes by sending a crafted API request . The vulnerability impacts Devolutions Server versions 2026...

CVE-2026-1768

CVE-2026-1768 describes a permission cache poisoning vulnerability in Devolutions Server that allows authenticated users to bypass permissions and access entries. Affected are Devolutions Server versions prior to 2025.3.15. The issue is confirmed across multiple sources and is addressed by upgrad...

CVE-2026-3130

Devolutions Server versions 2025.3.15 and earlier are vulnerable to an improper enforcement of behavioral controls. An authenticated attacker with delete permission can bypass intended protections to delete a Privileged Access Management (PAM) account that is currently checked out. This is achiev...

CVE-2026-9249

The Devolutions Server software is vulnerable to an unverified password change flaw. An attacker can change a user's password without providing the previous password by sending a crafted password change request . This issue affects versions 2026.1.6.0 through 2026.1.16.0 and versions 2025.3.20.0 ...

CVE-2025-8312

A deadlock vulnerability exists in the PAM automatic check-in feature of Devolutions Server . The issue is caused by a deadlock in the scheduling service , which allows a password to remain valid beyond its intended check-out period. This vulnerability affects Devolutions Server versions 2025.2.2...

CVE-2025-8353

Devolutions Server versions 2025.2.4.0 and earlier are affected by a UI synchronization issue within the Just-in-Time (JIT) access request approval interface . This vulnerability stems from a stale UI state during standard checkout request processing, which can allow a remote authenticated attack...

CVE-2025-13758

CVE-2025-13758 is tied to Devolutions Server and describes exposure of credentials in unintended requests. The connected Nessus entry (DEVO-2025-0018) confirms this issue alongside related CVEs and states affected versions include Devolutions Server up to 2025.2.20 and up to 2025.3.8, respectivel...

CVE-2026-3221

Devolutions Server versions 2025.3.14 and earlier are vulnerable because sensitive user account information is not encrypted in the database. This allows an attacker with direct database access to obtain sensitive user information. To address this, users should update to a version of Devolutions ...

CVE-2023-6264

The CVE-2023-6264 case concerns Devolutions Server (version 2023.3.7.0). The issue is an information leak in the Content-Security-Policy header that allows an unauthenticated attacker to list configured Devolutions Gateways endpoints, i.e., information disclosure with network access (no authentic...

CVE-2026-4924

The Devolutions Server software (versions 2026.1.11 and earlier) contains an improper authentication vulnerability in its two-factor authentication (2FA) feature. A remote attacker possessing valid credentials can bypass multi-factor authentication to gain unauthorized access to a victim's accoun...

CVE-2026-5146

Devolutions Server is vulnerable to an improper access control flaw in its notification management endpoints due to missing session validation . This allows an unauthenticated attacker to modify or delete arbitrary user notification records. The issue affects Devolutions Server versions 2026.1.6....

CVE-2026-8407

A missing authorization flaw in the PAM module of Devolutions Server allows an authenticated user with a PAM license, but no additional permissions, to obtain OTP secret keys and recovery codes . This is possible by sending crafted requests to the PAM API endpoints. The vulnerability affects Devo...

CVE-2025-13757

CVE-2025-13757 affects Devolutions Server. The issue is an SQL injection in the last usage logs, exploitable across affected builds through 2025.2.20 and 2025.3.8. CVSS v3.1 base score 8.8 (NETWORK, LOW complexity, LOW privileges, no user interaction). Impact is high on confidentiality, integrity...

CVE-2026-17569

An improper access control vulnerability exists in the NetBox synchronizer of Devolutions Server . This flaw allows an authenticated user with view-only permission on an entry to obtain a stored API token through the partial connection endpoint. Affected versions include Devolutions Server 2026.2...

CVE-2025-13683

Devolutions Server and Remote Desktop Manager on Windows are vulnerable to the exposure of credentials via unintended requests. This vulnerability specifically impacts Devolutions Server versions through 2025.3.8.0 and Remote Desktop Manager versions through 2025.3.23.0 . The issue involves an AI...

CVE-2026-3131

CVE-2026-3131 : Devolutions Server prior to 2025.3.14.0 suffers improper access control in multiple DVLS REST API endpoints, allowing an authenticated user with view-only permission to access sensitive connection data. Connected sources indicate remediation by upgrading to 2025.3.15.0 or later; o...

CVE-2026-3638

Devolutions Server versions 2025.3.11.0 and earlier are affected by an improper access control vulnerability in the user and role restore API endpoints . This flaw allows a low-privileged authenticated user to restore deleted users and roles by sending crafted API requests . While the specific te...

CVE-2026-9223

The Devolutions Server (versions 2026.1.16.0 and earlier) is vulnerable to a missing authorization flaw in the vault import feature . A low-privileged authenticated user can exploit this by sending a crafted import request to create new vaults. Remediation is typically achieved by upgrading to ve...

CVE-2026-9248

An authorization bypass exists in the entry duplication feature of Devolutions Server , affecting versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier . An authenticated user with write access to any vault can exploit this by sending a crafted save request to copy documentation and...

CVE-2026-12105

Devolutions Server versions 2026.2.5 and 2026.1.21 are affected by an improper access control vulnerability. This flaw allows an authenticated user to gain unauthorized access to attachments by utilizing a process involving folder duplication with inherited permissions . No exploit details or spe...

CVE-2026-4434

The Devolutions Server application is vulnerable to a security flaw where improper certificate validation occurs during PAM propagation WinRM connections . This vulnerability allows a network attacker to conduct a man-in-the-middle (MitM) attack by leveraging disabled TLS certificate verification...

CVE-2025-11957

Devolutions Server (versions up to and including 2025.2.12.0) is affected by an improper authorization vulnerability in the temporary access workflow. An authenticated basic user can self-approve or approve others’ temporary access requests, enabling unauthorized access to vaults and entries via ...

CVE-2026-4828

Improper authentication in the OAuth login functionality of Devolutions Server (versions 2026.1.11 and earlier ) allows a remote attacker with valid credentials to bypass multi-factor authentication (MFA) using a crafted login request. This vulnerability was first identified in early April 2026. ...

CVE-2025-12808

Devolutions Server is affected by a vulnerability where improper access control allows a View-only user to retrieve sensitive third-level nested fields , such as custom values within password lists. This flaw can lead to password disclosure . The issue impacts Devolutions Server versions 2025.3.2...

CVE-2026-15058

An improper authorization vulnerability exists in the secure messages deletion endpoint of Devolutions Server versions 2026.2.11 and 2026.1.22 . This flaw allows an authenticated user to delete messages belonging to another user by using a direct object reference to the message identifier. Exploi...

CVE-2026-15641

Devolutions Server versions 2026.2.11 and 2026.1.22 are vulnerable to an improper authorization flaw in the access request status endpoint . An authenticated low-privileged user can approve their own pending access requests by making a direct call to this endpoint, effectively bypassing the manda...

CVE-2026-4829

Devolutions Server versions 2026.1.11 and earlier are vulnerable to an improper authentication flaw in the external OAuth authentication flow. The root cause is the reuse of a session code from an external authentication flow, which allows an authenticated user to bypass security controls and aut...

CVE-2026-9522

Devolutions Server versions 2026.1.19 and earlier are vulnerable to improper access control within the PAM account discovery feature. This security flaw allows an authenticated user who lacks administrative privileges to delete network discovery scan configurations . To mitigate this issue, users...

CVE-2025-11619

Devolutions Server, a security solution for managing privileged accounts and sessions, is vulnerable to improper certificate validation when connecting to gateways. This flaw affects versions 2025.3.2 and earlier (specifically prior to 2025.3.3). An attacker positioned in a Man-in-the-Middle (Mit...

CVE-2026-11890

The Devolutions Server versions 2026.1.21 and 2026.2.5 are affected by a vulnerability involving improper access control in the PAM account discovery component. This flaw allows an authenticated user to retrieve account discovery scan results. While the vulnerability is confirmed in these specifi...

CVE-2026-15642

In Devolutions Server versions 2026.1.22.0 and 2026.2.11.0 , the Recovery Kit response file generation feature fails to properly sanitize output. This flaw allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext. This exposure occurs ...

CVE-2026-17570

Devolutions Server is impacted by CVE-2026-17570 , a vulnerability caused by improper access control in the PAM password history endpoints . This flaw allows an authenticated low-privileged user to disclose plaintext credential secrets by sending crafted API requests. The issue affects Devolution...

CVE-2025-12485

A vulnerability in Devolutions Server (versions 2025.3.2.0 through 2025.3.5.0 and 2025.2.15.0 and earlier) allows a low-privileged authenticated user to impersonate another account. The root cause is improper privilege management during the handling of pre-MFA cookies , which can be replayed by a...

CVE-2026-6706

Improper access control in the vault documentation feature of Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults by sending a crafted API request. This vulnerability affects versions 2026.1.6.0 through 2026.1.14.0 , as well as versions throu...