CVE-2025-1193

Devolutions Remote Desktop Manager versions 2024.3.19 and earlier on Windows are affected by an improper host validation vulnerability in the certificate validation component . This flaw allows an attacker to perform a man-in-the-middle (MITM) attack by presenting a certificate for a different ho...

CVE-2025-1635

Devolutions Remote Desktop Manager version 2024.3.29 and earlier on Windows is affected by a security vulnerability (CVE-2025-1635). A faulty business logic error in the hub data source export feature allows a user to inadvertently include their authenticated session within an exported hub data s...

CVE-2025-2528

Devolutions Remote Desktop Manager on Windows is affected by an improper authorization flaw in the application password policy. This vulnerability allows an authenticated user to utilize a configuration that differs from the requirements mandated by system administrators. The issue impacts versio...

CVE-2025-2600

An improper authorization vulnerability exists in the variable component of Devolutions Remote Desktop Manager on Windows. This flaw allows an authenticated user to utilize the ELEVATED_PASSWORD variable even when restricted by the "Allow password in variable policy" . This issue affects versions...

CVE-2024-11670

The Devolutions Remote Desktop Manager (version 2024.2.21 and earlier ) on Windows is vulnerable to an incorrect authorization flaw in the permission validation component (also referred to as the Privilege Authentication component ). A malicious authenticated user can exploit this flaw via specif...

CVE-2025-5334

Devolutions Remote Desktop Manager (versions Windows 2025.1.34.0 and earlier, macOS 2025.1.16.3 and earlier, Android 2025.1.3.3 and earlier, and iOS 2025.1.6.0 and earlier) is vulnerable to a private information exposure flaw. The root cause is improper access control within the user vaults compo...

CVE-2024-11672

Devolutions Remote Desktop Manager versions 2024.2.21 and earlier on Windows are affected by an incorrect authorization vulnerability in the add permission component . This flaw allows an authenticated malicious user to bypass the "Add" permission by utilizing the import in vault feature. To reme...

CVE-2024-12149

The Devolutions Remote Desktop Manager (version 2024.3.19.0 and earlier) on Windows is affected by a vulnerability where an incorrect permission assignment in the temporary access requests component allows an authenticated user to obtain more privileges than requested. This flaw can lead to privi...

CVE-2024-11671

Devolutions Remote Desktop Manager versions 2024.3.17 and earlier on Windows are vulnerable to an improper authentication flaw in SQL data source MFA validation. An authenticated user can bypass MFA validation by performing data source switching , potentially leading to unauthorized access . As a...

CVE-2025-2562

Devolutions Remote Desktop Manager on Windows contains an insufficient logging vulnerability in its autotyping feature. This flaw allows an authenticated user to utilize a stored password without triggering a corresponding log event when using the autotyping functionality. This issue affects vers...

CVE-2025-2499

Devolutions Remote Desktop Manager on Windows is affected by a client-side access control bypass in the permission component . An authenticated user can exploit this flaw by performing specific actions to bypass restrictions on View Password , Edit Asset , and Edit Permissions . This vulnerabilit...

CVE-2025-1636

Devolutions Remote Desktop Manager version 2024.3.29 and earlier on Windows is susceptible to a vulnerability in the My Personal Credentials password history component. Due to faulty business logic , an authenticated user can inadvertently leak personal credentials into a shared vault when using ...

CVE-2024-6057

Devolutions Remote Desktop Manager versions 2024.1.31.0 and earlier are affected by an improper authentication vulnerability in the vault password feature. An attacker who has already compromised access to an RDM instance can bypass the vault master password by leveraging the offline mode feature...

CVE-2024-6354

Devolutions Remote Desktop Manager versions 2024.2.11 and earlier on Windows are affected by an improper access control vulnerability in the PAM dashboard . This flaw allows an authenticated user to bypass the execute permission by utilizing the PAM dashboard. No specific exploit details or remed...

CVE-2026-12161

Devolutions Remote Desktop Manager versions 2026.2.5.0 through 2026.2.7.0 and 2026.1.23.0 and earlier are vulnerable to a command injection flaw (CVE-2026-12161). The root cause is improper input validation within the SSH Elevate Shell feature. An authenticated user with permissions to create or ...

CVE-2024-11621

Devolutions Remote Desktop Manager is vulnerable to a trust management issue due to missing certificate validation . This flaw allows an attacker to perform a man-in-the-middle (MITM) attack to intercept and modify encrypted communications. Affected versions include macOS 2024.3.9.0 and earlier, ...

CVE-2024-6055

Devolutions Remote Desktop Manager versions 2024.1.32.0 and earlier on Windows are vulnerable to the improper removal of sensitive information within the data source export feature . An attacker who obtains the exported settings can steal the configuration file to recover PowerShell credentials c...

CVE-2024-6492

The Devolutions Remote Desktop Manager (versions 2024.2.14.0 and earlier) on Windows is vulnerable to an information exposure flaw in its edge browser session proxy feature . An attacker can leverage a specially crafted website to intercept proxy credentials . As of the provided documentation, th...

CVE-2024-3545

Devolutions Remote Desktop Manager (version 2024.1.20 and earlier on Windows) and Devolutions Server (version 2024.1.8 and earlier) are vulnerable to improper permission handling within the vault offline cache feature. An attacker who gains access to a computer where the software is installed can...

CVE-2026-0747

The Devolutions Remote Desktop Manager software for Windows versions 2025.3.24.0 through 2025.3.28.0 is vulnerable to a sensitive information exposure flaw. A defective masking feature in the TeamViewer entry dashboard component allows an external observer to view a password on the screen, which ...

CVE-2026-2590

The Devolutions Remote Desktop Manager software (versions 2025.3.30 and earlier ) is vulnerable to a sensitive information exposure flaw. The root cause is an improper enforcement of the "Disable password saving in vaults" setting within the connection entry component . This allow an authenticate...

CVE-2026-12162

Devolutions Remote Desktop Manager version 2026.2.8 and earlier is vulnerable to an improper host validation flaw in its social login autofill feature. An attacker can exploit this by using a crafted web entry that points to a provider lookalike domain , which may lead to the disclosure of stored...

CVE-2025-13683

Devolutions Server and Remote Desktop Manager on Windows are vulnerable to the exposure of credentials in unintended requests . This vulnerability specifically impacts Devolutions Server versions through 2025.3.8.0 and Remote Desktop Manager versions through 2025.3.23.0 . The issue is characteriz...

CVE-2026-13372

Devolutions Remote Desktop Manager versions 2026.2.5 through 2026.2.11 are vulnerable to a code execution flaw. The issue resides in the custom PowerShell VPN editor , where incorrect link resolution based on display names allows an authenticated attacker with write access to a shared workspace t...