Devolutions Server CVE-2025-11958

Exploitation requires an authenticated session with high privileges (PR:H) on a Devolutions Server instance running version 2025.2.15.0 or earlier, and the attacker must be able to reach the Security Dashboard ignored-tasks API endpoint. The specific vulnerable surface is that ignored-tasks API, which fails to properly validate input in a crafted request. Limiting factors: the PR:H requirement means only already-privileged accounts (or hijacked privileged sessions) can trigger it, the impact is confined to availability of the Security Dashboard rather than the whole server, and patched versions after 2025.2.15.0 are not affected. No user interaction is required (UI:N).

This is a low-to-moderate priority issue despite the medium 5.1 CVSS 4.0 score. The vendor-supplied vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L) describes a network-reachable but high-privilege-gated flaw whose only impact is partial availability loss (VA:L) scoped to the Security Dashboard - no confidentiality or integrity impact. The requirement for high privileges (PR:H) is the dominant mitigating factor: an attacker must already hold a privileged authenticated account on the Devolutions Server instance, which sharply limits the realistic attacker population to insiders or already-compromised privileged sessions. All exploitation signals point the same direction and are consistent rather than conflicting: EPSS is low (0.45%, 37th percentile), there is no CISA KEV listing, and no public exploit code is referenced. There is no SSVC decision data in the input to incorporate. The net picture is a genuine but narrow availability bug - not a high-CVSS-but-low-real-risk mislabel, but equally not a widespread-exploitation emergency - best handled through normal patch cycles.

A user who already holds a high-privilege account on Devolutions Server sends a crafted request to the Security Dashboard ignored-tasks API, triggering the improper input validation (CWE-20) and rendering the Security Dashboard unavailable to administrators. No public exploit code has been identified at time of analysis, and the network attack vector with low complexity means the malformed request itself is trivial to deliver once the attacker is authenticated.