CVE-2025-1231

The Devolutions Server platform, versions 2024.3.10.0 and earlier , is susceptible to an improper password reset vulnerability in its PAM Module . A crash in the password reset functionality allows an authenticated user to reuse an oracle user password after check-in. Exploitation of this flaw ma...

CVE-2025-2280

Devolutions Server versions 2024.3.13 and earlier are affected by an improper access control vulnerability in the web extension restriction feature . This flaw allows an authenticated user to successfully bypass the browser extension restriction feature . While technical details regarding the roo...

CVE-2025-4316

Devolutions Server versions 2025.1.6.0 and earlier (specifically 2025.1.3.0 through 2025.1.6.0 and all versions up to 2024.3.15.0 ) are affected by an improper access control vulnerability in the PAM feature . This flaw allows a PAM user to self-approve their own PAM requests, even when prohibite...

CVE-2025-2278

The Devolutions Server (version 2024.3.13 and earlier) is vulnerable to an improper access control flaw within its temporary access requests and checkout requests endpoints. An authenticated user can exploit this by using a known request ID to access sensitive information associated with those re...

CVE-2025-2003

Devolutions Server version 2024.3.12 and earlier versions are affected by a vulnerability involving incorrect authorization in PAM vaults . This flaw allows an authenticated user to bypass the 'add in root' permission. While the documents confirm the existence of the vulnerability and the impacte...

CVE-2025-0691

Devolutions Server versions 2025.1.10.0 and earlier are vulnerable to an improper access control flaw within the permissions component. An authenticated user can bypass the "Edit permission" by circumventing client-side validation. This allows for unauthorized actions despite the intended permiss...

CVE-2025-3517

Devolutions Server version 2025.1.5.0 and earlier is susceptible to an incorrect privilege assignment within the PAM JIT elevation feature. The root cause is a failure to update the internal account's SID when a username is updated, which can allow a PAM user to elevate a previously configured us...

CVE-2025-4433

CVE-2025-4433 affects Devolutions Server (versions 2025.1.7.0 and earlier). The vulnerability arises from improper access control in User Group Management, enabling a non-administrative user who has both User Management and User Group Management permissions to escalate privileges by adding users ...

CVE-2025-5382

Devolutions Server versions 2025.1.7.0 and earlier are affected by an improper access control vulnerability in the Multi-Factor Authentication (MFA) feature. A user possessing user management permissions can exploit this flaw to remove or modify the MFA settings of administrators. To mitigate thi...

CVE-2025-2277

The Devolutions Server (version 2024.3.13 and earlier ) is affected by a vulnerability in its web-based SSH authentication component . The root cause is a missing password masking mechanism, which allows a user to unadvertently leak their SSH password. While the vulnerability is documented across...

CVE-2025-3768

Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feature when the Devolutions hosted endpoint is not reachable.

CVE-2025-4493

Devolutions Server is affected by an improper privilege assignment vulnerability (CVE-2025-4493) in PAM JIT privilege sets . A PAM user can exploit a user interface issue to perform PAM JIT requests on unauthorized groups. This vulnerability impacts versions 2024.3.15.0 and earlier and 2025.1.3.0...

CVE-2025-13765

CVE-2025-13765 affects Devolutions Server, where email service credentials are exposed to non-administrative users. Public details in connected documents specify affected versions as before 2025.2.21 and before 2025.3.9. The issue’s root cause is credential exposure in the email service, with mul...

CVE-2025-8353

Devolutions Server versions 2025.2.4.0 and earlier are affected by a UI synchronization issue within the Just-in-Time (JIT) access request approval interface . This vulnerability allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups by leveraging a stale UI stat...

CVE-2025-11958

Devolutions Server

CVE-2025-13683

Devolutions Server and Remote Desktop Manager on Windows are vulnerable to the exposure of credentials in unintended requests . This vulnerability specifically impacts Devolutions Server versions through 2025.3.8.0 and Remote Desktop Manager versions through 2025.3.23.0 . The issue is characteriz...

CVE-2025-8312

Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service.This issue affects the following version(s) : Devolutions Server 2025.2.2.0 through 2025.2.5.0 D...

CVE-2025-13757

CVE-2025-13757 affects Devolutions Server. The issue is an SQL injection in the last usage logs, exploitable across affected builds through 2025.2.20 and 2025.3.8. CVSS v3.1 base score 8.8 (NETWORK, LOW complexity, LOW privileges, no user interaction). Impact is high on confidentiality, integrity...

CVE-2025-13758

CVE-2025-13758 is tied to Devolutions Server and describes exposure of credentials in unintended requests. The connected Nessus entry (DEVO-2025-0018) confirms this issue alongside related CVEs and states affected versions include Devolutions Server up to 2025.2.20 and up to 2025.3.8, respectivel...

CVE-2025-11957

Devolutions Server (versions up to and including 2025.2.12.0) is affected by an improper authorization vulnerability in the temporary access workflow. An authenticated basic user can self-approve or approve others’ temporary access requests, enabling unauthorized access to vaults and entries via ...

CVE-2025-6741

CVE-2025-6741 describes improper access control in the Devolutions Server secure message component, enabling an authenticated user to steal unauthorized entries via the secure message entry attachment feature. Affected are Devolutions Server 2025.2.2.0–2025.2.4.0 and 2025.1.11.0 and earlier. Root...

CVE-2025-6523

CVE-2025-6523 affects Devolutions Server, where the emergency authentication component allows unauthenticated bypass via brute-forcing short emergency codes. Affected are Devolutions Server 2025.2.2.0–2025.2.3.0 and 2025.1.11.0 and earlier. Root cause is use of weak credentials in the emergency a...

CVE-2025-12808

Devolutions Server is vulnerable to an improper access control flaw, where a View-only user can retrieve sensitive third-level nested fields, specifically custom values within password lists. This flaw can result in password disclosure . The vulnerability affects Devolutions Server versions 2025....

CVE-2025-12485

A security vulnerability in Devolutions Server (versions 2025.3.2.0 through 2025.3.5.0 and 2025.2.15.0 and earlier ) arises from improper privilege management during the handling of pre-MFA cookies . This flaw allows a low-privileged authenticated user to impersonate another account by replaying ...

CVE-2025-11619

The Devolutions Server security solution for privileged account and session management is vulnerable to an improper certificate validation flaw when connecting to gateways. This issue affects versions 2025.3.2 and earlier . An attacker positioned in a Man-in-the-Middle (MitM) position can exploit...