CVE-2024-2921

Devolutions Server version 2024.1.10.0 and earlier (also noted as 2024.1.6 and prior in some records) is susceptible to an improper access control vulnerability within the PAM vault permissions . This flaw allows an authenticated user who has access to the PAM to gain unauthorized access to speci...

CVE-2025-2280

Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser extension restriction feature.

CVE-2024-1764

The Devolutions Server (version 2023.3.14.0 and earlier) is affected by a vulnerability involving improper privilege management within the Just-in-time (JIT) elevation module . Under specific circumstances, this flaw allows a user to maintain elevated privileges even after they have expired. No s...

CVE-2025-3517

Devolutions Server version 2025.1.5.0 and earlier is susceptible to an incorrect privilege assignment within the PAM JIT elevation feature. The root cause is a failure to update the internal account's SID when a username is updated, which can allow a PAM user to elevate a previously configured us...

CVE-2025-5382

Devolutions Server versions 2025.1.7.0 and earlier are affected by an improper access control vulnerability in the Multi-Factor Authentication (MFA) feature. A user possessing user management permissions can exploit this flaw to remove or modify the MFA settings of administrators. To mitigate thi...

CVE-2024-12148

Devolutions Server versions 2024.3.6.0 and earlier are affected by a vulnerability involving incorrect authorization in the permission validation component. This flaw allows an authenticated user to gain unauthorized access to certain reporting endpoints . According to the documentation, exploita...

CVE-2025-2277

Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking.

CVE-2025-4493

Devolutions Server is affected by an improper privilege assignment vulnerability (CVE-2025-4493) in PAM JIT privilege sets . A PAM user can exploit a user interface issue to perform PAM JIT requests on unauthorized groups. This vulnerability impacts versions 2024.3.15.0 and earlier and 2025.1.3.0...

CVE-2024-1900

Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticated user via an identity provider to stay authenticated after his user is disabled or deleted in the identity provider such as Okta or Microsoft O365. The use...

CVE-2024-3545

Devolutions Remote Desktop Manager (version 2024.1.20 and earlier on Windows) and Devolutions Server (version 2024.1.8 and earlier) are vulnerable to improper permission handling within the vault offline cache feature. An attacker who gains access to a computer where the software is installed can...

CVE-2026-10787

The Devolutions Server software is vulnerable to a missing authorization flaw in its deleted user groups API . This vulnerability allows an authenticated low-privileged user to enumerate metadata of deleted user groups by sending a crafted API request . The affected versions include Devolutions S...

CVE-2026-0610

SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12

CVE-2026-10786

Devolutions Server is vulnerable to an improper access control flaw in its ticketing integration settings. This vulnerability allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations by sending a crafted API request. This issue specifically...

CVE-2026-9590

Devolutions Server versions 2026.1.19 and earlier are susceptible to an improper access control vulnerability in the permission validation component . This flaw allows an authenticated user possessing entry edit privileges to modify asset information without having the specific required permissio...

CVE-2026-15637

The Devolutions Server software versions 2026.2.11 and 2026.1.22 are affected by an improper authorization vulnerability. An authenticated low-privileged user can disclose the private key of an SSH key or certificate PAM credential by using a direct object reference to the credential identifier. ...

CVE-2026-9224

The Devolutions Server is vulnerable to a missing authorization flaw in its user profile update feature. This security oversight allows an authenticated Active Directory user to modify their own profile attributes by sending a crafted API request . The vulnerability specifically impacts Devolutio...

CVE-2026-10544

Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : Devolutions ...

CVE-2026-5171

Devolutions Server is impacted by an improper access control vulnerability in its entry activity log feature. An authenticated user who has access to an entry, but lacks the specific required permissions, can retrieve that entry's activity logs by sending a crafted API request . This issue affect...

CVE-2026-3130

Devolutions Server versions 2025.3.15 and earlier are vulnerable to an improper enforcement of behavioral controls in PAM multi-account deletion. An authenticated attacker with delete permission can delete a PAM account that is currently checked out by performing a bulk deletion operation that in...

CVE-2026-17568

Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : Devolutions Serv...

CVE-2026-9047

Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors. This issue affects : Devolutions Ser...

CVE-2026-5146

The Devolutions Server software is vulnerable to improper access control within its notification management endpoints. Due to missing session validation , an unauthenticated attacker can modify or delete arbitrary user notification records. This vulnerability affects Devolutions Server versions 2...

CVE-2026-3221

Devolutions Server versions 2025.3.14 and earlier are vulnerable because sensitive user account information is not encrypted in the database. This allows an attacker with direct database access to obtain sensitive user information. To address this, users should update to a version of Devolutions ...

CVE-2026-9248

An authorization bypass exists in the entry duplication (or replication) feature of Devolutions Server . An authenticated user with write access to any vault can exploit this by sending a crafted save request to copy documentation and attachments from an entry in a vault they are not authorized t...

CVE-2025-13683

Devolutions Server and Remote Desktop Manager on Windows are vulnerable to the exposure of credentials in unintended requests . This vulnerability specifically impacts Devolutions Server versions through 2025.3.8.0 and Remote Desktop Manager versions through 2025.3.23.0 . The issue is characteriz...

CVE-2026-17569

Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2...

CVE-2026-12105

The Devolutions Server versions 2026.2.5 and 2026.1.21 are affected by an improper access control vulnerability (CVE-2026-12105). This flaw allows an authenticated user to gain unauthorized access to attachments by performing a folder duplication with inherited permissions . While the vulnerabili...

CVE-2026-4434

The Devolutions Server application is vulnerable to a man-in-the-middle (MitM) attack due to improper certificate validation in the PAM propagation WinRM connections . A network attacker can exploit this by leveraging disabled TLS certificate verification to intercept connections. While the vulne...

CVE-2026-8407

Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : Devolutions Server 2026.1...

CVE-2026-1007

Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.

CVE-2026-15058

Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.

CVE-2026-4829

The Devolutions Server (versions prior to 2026.1.11 or 2026.1.x prior to 2026.1.12 ) is affected by an improper authentication vulnerability in the external OAuth authentication flow . This flaw allows an authenticated user to impersonate other users, including administrators , by reusing a sessi...

CVE-2026-11890

Devolutions Server versions 2026.1.21 and 2026.2.5 are affected by an improper access control vulnerability in the PAM account discovery function. This flaw allows an authenticated user to retrieve account discovery scan results. While the impact involves unauthorized data access, no specific exp...

CVE-2026-3204

Devolutions Server versions 2025.3.15 and earlier are vulnerable to an improper input validation flaw in the error message page. This vulnerability allows remote attackers to spoof the displayed error message by providing a specially crafted URL. Remediation requires updating the software to a ve...

CVE-2025-12808

Devolutions Server is vulnerable to an improper access control flaw, where a View-only user can retrieve sensitive third-level nested fields, specifically custom values within password lists. This flaw can result in password disclosure . The vulnerability affects Devolutions Server versions 2025....

CVE-2026-15642

The Devolutions Server versions 2026.1.22.0 and 2026.2.11.0 are vulnerable to the insertion of sensitive information in the Recovery Kit response file generation feature. This flaw allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in clearte...

CVE-2026-4927

Devolutions Server versions 2026.1.6 through 2026.1.11 are vulnerable to an information exposure flaw in the Multi-Factor Authentication (MFA) feature. An authenticated user with user management privileges can perform an authenticated API request to obtain the OTP keys of other users. This vulner...

CVE-2026-5175

The Devolutions Server software (versions 2026.1.6 through 2026.1.11 ) is vulnerable to an improper access control flaw in the multi-factor authentication (MFA) management API. An authenticated attacker can exploit this by sending crafted HTTP requests to delete their own configured MFA factors. ...

CVE-2026-6706

Devolutions Server is affected by an improper access control vulnerability in its vault documentation feature. An authenticated attacker can exploit this flaw by sending a crafted API request to read documentation content from unauthorized vaults. This issue impacts versions 2026.1.6.0 through 20...

CVE-2025-12485

Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions : D...

CVE-2026-17570

Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : Devolutions Server 2026.2.4.0 through 2026.2.12.0 Devolutions Server 2026.1.23.0 ...

CVE-2026-3638

Devolutions Server versions 2025.3.11.0 and earlier are vulnerable to an improper access control flaw in the user and role restore API endpoints . This vulnerability allows a low-privileged authenticated user to restore deleted users and roles by sending crafted API requests . No specific exploit...

CVE-2026-4925

Devolutions Server versions 2026.1.6 through 2026.1.11 are vulnerable to an improper access control flaw in the users Multi-Factor Authentication (MFA) feature. This vulnerability allows an authenticated user to bypass administrator-enforced restrictions and remove their own MFA configuration by ...