CVE-2025-1231

The Devolutions Server platform, versions 2024.3.10.0 and earlier , is susceptible to an improper password reset vulnerability in its PAM Module . A crash in the password reset functionality allows an authenticated user to reuse an oracle user password after check-in. Exploitation of this flaw ma...

CVE-2025-2280

Devolutions Server versions 2024.3.13 and earlier are affected by an improper access control vulnerability in the web extension restriction feature . This flaw allows an authenticated user to successfully bypass the browser extension restriction feature . While technical details regarding the roo...

CVE-2025-4316

Devolutions Server versions 2025.1.6.0 and earlier (specifically 2025.1.3.0 through 2025.1.6.0 and all versions up to 2024.3.15.0 ) are affected by an improper access control vulnerability in the PAM feature . This flaw allows a PAM user to self-approve their own PAM requests, even when prohibite...

CVE-2025-2278

The Devolutions Server (version 2024.3.13 and earlier) is vulnerable to an improper access control flaw within its temporary access requests and checkout requests endpoints. An authenticated user can exploit this by using a known request ID to access sensitive information associated with those re...

CVE-2025-2003

Devolutions Server version 2024.3.12 and earlier versions are affected by a vulnerability involving incorrect authorization in PAM vaults . This flaw allows an authenticated user to bypass the 'add in root' permission. While the documents confirm the existence of the vulnerability and the impacte...

CVE-2025-3517

Devolutions Server version 2025.1.5.0 and earlier is susceptible to an incorrect privilege assignment within the PAM JIT elevation feature. The root cause is a failure to update the internal account's SID when a username is updated, which can allow a PAM user to elevate a previously configured us...

CVE-2025-4433

CVE-2025-4433 affects Devolutions Server (versions 2025.1.7.0 and earlier). The vulnerability arises from improper access control in User Group Management, enabling a non-administrative user who has both User Management and User Group Management permissions to escalate privileges by adding users ...

CVE-2025-5382

Devolutions Server versions 2025.1.7.0 and earlier are affected by an improper access control vulnerability in the Multi-Factor Authentication (MFA) feature. A user possessing user management permissions can exploit this flaw to remove or modify the MFA settings of administrators. To mitigate thi...

CVE-2025-2277

The Devolutions Server (version 2024.3.13 and earlier ) is affected by a vulnerability in its web-based SSH authentication component . The root cause is a missing password masking mechanism, which allows a user to unadvertently leak their SSH password. While the vulnerability is documented across...

CVE-2025-13765

CVE-2025-13765 affects Devolutions Server, where email service credentials are exposed to non-administrative users. Public details in connected documents specify affected versions as before 2025.2.21 and before 2025.3.9. The issue’s root cause is credential exposure in the email service, with mul...

CVE-2025-8353

Devolutions Server versions 2025.2.4.0 and earlier are affected by a UI synchronization issue within the Just-in-Time (JIT) access request approval interface . This vulnerability allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups by leveraging a stale UI stat...

CVE-2025-13683

Devolutions Server and Remote Desktop Manager on Windows are vulnerable to the exposure of credentials in unintended requests . This vulnerability specifically impacts Devolutions Server versions through 2025.3.8.0 and Remote Desktop Manager versions through 2025.3.23.0 . The issue is characteriz...

CVE-2025-8312

A deadlock vulnerability exists in the PAM automatic check-in feature of Devolutions Server . The issue is caused by a deadlock occurring in the scheduling service , which allows a password to remain valid beyond its intended check-out period. This vulnerability affects Devolutions Server version...

CVE-2025-13757

CVE-2025-13757 affects Devolutions Server. The issue is an SQL injection in the last usage logs, exploitable across affected builds through 2025.2.20 and 2025.3.8. CVSS v3.1 base score 8.8 (NETWORK, LOW complexity, LOW privileges, no user interaction). Impact is high on confidentiality, integrity...

CVE-2025-13758

CVE-2025-13758 is tied to Devolutions Server and describes exposure of credentials in unintended requests. The connected Nessus entry (DEVO-2025-0018) confirms this issue alongside related CVEs and states affected versions include Devolutions Server up to 2025.2.20 and up to 2025.3.8, respectivel...

CVE-2025-11957

Devolutions Server (versions up to and including 2025.2.12.0) is affected by an improper authorization vulnerability in the temporary access workflow. An authenticated basic user can self-approve or approve others’ temporary access requests, enabling unauthorized access to vaults and entries via ...

CVE-2025-12808

Devolutions Server is vulnerable to an improper access control flaw, where a View-only user can retrieve sensitive third-level nested fields, specifically custom values within password lists. This flaw can result in password disclosure . The vulnerability affects Devolutions Server versions 2025....

CVE-2025-12485

A security vulnerability in Devolutions Server (versions 2025.3.2.0 through 2025.3.5.0 and 2025.2.15.0 and earlier ) arises from improper privilege management during the handling of pre-MFA cookies . This flaw allows a low-privileged authenticated user to impersonate another account by replaying ...

CVE-2025-11619

The Devolutions Server security solution for privileged account and session management is vulnerable to an improper certificate validation flaw when connecting to gateways. This issue affects versions 2025.3.2 and earlier . An attacker positioned in a Man-in-the-Middle (MitM) position can exploit...