Skip to main content

Devolutions Server CVE-2026-0610

CRITICAL
SQL Injection (CWE-89)
2026-01-19 security@devolutions.net
SQLi Devolutions Server
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 19, 2026 - 15:15 nvd
CRITICAL 9.8

DescriptionCVE.org

SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12

AnalysisAI

Devolutions Server 2025.3.1 through 2025.3.6 contains a SQL injection vulnerability in the remote sessions component that allows attackers to manipulate database queries.

Technical ContextAI

The remote-sessions component of Devolutions Server has a CWE-89 SQL injection vulnerability that allows attackers to inject arbitrary SQL commands through session management functionality.

RemediationAI

Upgrade Devolutions Server to 2025.3.7 or later immediately. Rotate all credentials stored in the vault. Audit session logs.

More in Devolutions Server

View all
CVE-2026-3204 CRITICAL
9.8 Mar 03

Input validation flaw in Devolutions Server error message page enables remote spoofing attacks.
CVE-2026-3224 CRITICAL
9.8 Mar 03

Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
CVE-2026-3130 CRITICAL
9.8 Mar 03

Behavioral control bypass in Devolutions Server 2025.3.15 allows authenticated users to exploit delete permissions.
CVE-2024-2921 CRITICAL
9.8 Mar 26

Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated u
CVE-2021-23921 CRITICAL
9.1 Apr 01

An issue was discovered in Devolutions Server before 2020.3. Rated critical severity (CVSS 9.1), this vulnerability is r
CVE-2025-13757 HIGH
8.8 Nov 27

SQL Injection vulnerability in last usage logs in Devolutions Server.2.20, through 2025.3.8. Rated high severity (CVSS 8
CVE-2024-2915 HIGH
8.8 Mar 26

Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access t
CVE-2023-0953 HIGH
8.8 Mar 01

Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authe
CVE-2023-0951 HIGH
8.8 Mar 01

Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privil
CVE-2022-33996 HIGH
8.8 Jul 07

Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inh
CVE-2025-4433 HIGH
8.7 May 30

Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrativ
CVE-2025-2280 HIGH
8.1 Mar 13

Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an auth

Same weakness CWE-89 – SQL Injection

View all
CVE-2023-48788 CRITICAL POC
9.8
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2015-7297 HIGH POC
7.5

Same technique SQLi

View all
CVE-2025-57819 CRITICAL POC
10.0
CVE-2017-8917 CRITICAL POC
9.8
CVE-2024-27956 CRITICAL POC
9.9
CVE-2014-3704 HIGH POC
7.5
CVE-2016-2555 CRITICAL POC
9.8
CVE-2016-8582 CRITICAL POC
9.8
CVE-2013-0333 HIGH POC
7.5
CVE-2015-7297 HIGH POC
7.5

Share

CVE-2026-0610 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy