CVE-2024-2921

Devolutions Server versions 2024.1.6 and earlier are affected by an improper access control vulnerability in PAM vault permissions . An authenticated user with access to the PAM can exploit a specific set of permissions to access unauthorized PAM entries . While a patch version is not explicitly ...

CVE-2021-23921

CVE-2021-23921 affects Devolutions Server prior to 2020.3. The issue is broken access control on Password List entry elements, as described in the CVE entry and corroborated by NVD/related records. The connected documents confirm the affected software and the underlying flaw (inadequate access re...

CVE-2026-3224

Devolutions Server versions 2025.3.15.0 and earlier are vulnerable to an authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode. An unauthenticated attacker can authenticate as an arbitrary Entra ID user by providing a forged JSON Web Token (JWT) to the /api/v1/login endpo...

CVE-2026-0610

Devolutions Server versions 2025.3.1 through 2025.3.12 are susceptible to a SQL Injection vulnerability within the remote-sessions component. An attacker could exploit this by sending crafted SQL queries to potentially gain unauthorized access or perform unauthorized modification of data . Remedi...

CVE-2026-3130

Devolutions Server versions 2025.3.15 and earlier are vulnerable to an improper enforcement of behavioral controls. An authenticated attacker with delete permission can bypass intended protections to delete a Privileged Access Management (PAM) account that is currently checked out. This is achiev...

CVE-2025-11957

Devolutions Server (versions up to and including 2025.2.12.0) is affected by an improper authorization vulnerability in the temporary access workflow. An authenticated basic user can self-approve or approve others’ temporary access requests, enabling unauthorized access to vaults and entries via ...

CVE-2025-6523

CVE-2025-6523 affects Devolutions Server, where the emergency authentication component allows unauthenticated bypass via brute-forcing short emergency codes. Affected are Devolutions Server 2025.2.2.0–2025.2.3.0 and 2025.1.11.0 and earlier. Root cause is use of weak credentials in the emergency a...

CVE-2026-3204

Devolutions Server versions 2025.3.16 and earlier are vulnerable to improper input validation in the error message page. A remote attacker can exploit this flaw by using a specially crafted URL to spoof the displayed error message. To mitigate this risk, it is recommended to update Devolutions Se...