CVE-2021-23923

The CVE concerns Devolutions Server prior to 2020.3 with a Broken Authentication issue involving Windows domain users. Public documents identify affected software and the vulnerability type but do not provide exploit details, exact root cause, or remediation steps within the supplied sources. Mon...

CVE-2025-2280

The Devolutions Server (versions 2024.3.13 and earlier) is vulnerable to an improper access control flaw in the web extension restriction feature. This security weakness allows an authenticated user to bypass the browser extension restriction feature. The impact of this vulnerability is categoriz...

CVE-2022-33996

CVE-2022-33996 affects Devolutions Server older than 2022.2. The issue is incorrect permission management where a new user with a preexisting username inherits the permissions of the previous user. Documented impact includes potential confidentiality, integrity, and availability concerns, with CV...

CVE-2024-2915

The Devolutions Server software (version 2024.1.6 and earlier ) is susceptible to an improper access control vulnerability within the PAM JIT elevation feature. An attacker who can access this specific feature may submit a specially crafted request to elevate their privileges to unauthorized grou...

CVE-2023-0951

CVE-2023-0951 affects Devolutions Server 2022.3.12 and earlier, due to improper access controls on certain API endpoints. A standard privileged user could perform privileged actions, with impact described as high for confidentiality, integrity, and availability. The provided documents identify th...

CVE-2025-4433

CVE-2025-4433 affects Devolutions Server (versions 2025.1.7.0 and earlier). The vulnerability arises from improper access control in User Group Management, enabling a non-administrative user who has both User Management and User Group Management permissions to escalate privileges by adding users ...

CVE-2023-0953

The CVE concerns Devolutions Server (version 2022.3.12 and earlier). The root cause is insufficient input sanitization in the documentation feature, enabling an authenticated attacker to perform an SQL Injection and potentially access system resources. Impact is described as high (C/H/I/A), with ...

CVE-2026-17568

Improper access control in the role membership management endpoint of Devolutions Server allows an authenticated non-administrative user to escalate privileges to administrator . This vulnerability is triggered by sending a crafted API request by a user who already holds the user-group membership...

CVE-2026-14536

CVE-2026-14536 affects Devolutions Server 2026.2.9.0. The issue is improper enforcement of a mandatory multi-factor authentication policy, allowing an attacker with valid credentials to bypass MFA and authenticate without completing MFA due to an invalid default MFA value. The available sources d...

CVE-2025-13757

CVE-2025-13757 affects Devolutions Server. The issue is an SQL injection in the last usage logs, exploitable across affected builds through 2025.2.20 and 2025.3.8. CVSS v3.1 base score 8.8 (NETWORK, LOW complexity, LOW privileges, no user interaction). Impact is high on confidentiality, integrity...

CVE-2026-4924

The Devolutions Server software (versions 2026.1.11 and earlier) contains an improper authentication vulnerability in its two-factor authentication (2FA) feature. A remote attacker possessing valid credentials can bypass multi-factor authentication to gain unauthorized access to a victim's accoun...

CVE-2026-4434

The Devolutions Server application is vulnerable to a security flaw where improper certificate validation occurs during PAM propagation WinRM connections . This vulnerability allows a network attacker to conduct a man-in-the-middle (MitM) attack by leveraging disabled TLS certificate verification...

CVE-2026-4828

Improper authentication in the OAuth login functionality of Devolutions Server (versions 2026.1.11 and earlier ) allows a remote attacker with valid credentials to bypass multi-factor authentication (MFA) using a crafted login request. This vulnerability was first identified in early April 2026. ...

CVE-2025-12485

A vulnerability in Devolutions Server (versions 2025.3.2.0 through 2025.3.5.0 and 2025.2.15.0 and earlier) allows a low-privileged authenticated user to impersonate another account. The root cause is improper privilege management during the handling of pre-MFA cookies , which can be replayed by a...

CVE-2025-11619

Devolutions Server, a security solution for managing privileged accounts and sessions, is vulnerable to improper certificate validation when connecting to gateways. This flaw affects versions 2025.3.2 and earlier (specifically prior to 2025.3.3). An attacker positioned in a Man-in-the-Middle (Mit...