Devolutions Server
CVE-2026-1007
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as high-privilege user
-
ExploitCraft request to virtual gateway component
-
ExecutionBypass deny IP rules
-
ImpactAccess restricted resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | High-privileged account required. Virtual gateway component must be deployed and active. Affected versions: Devolutions Server 2025.3.1 through 2025.3.12. |
| Impact | CVSS 7.6 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: High. User interaction: None. |
| Exploit ScenarioDerived | An attacker could exploit this vulnerability to bypass deny IP rules. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
Devolutions Server versions 2025.3.1 through 2025.3.12 contain an authorization bypass in the virtual gateway component that allows authenticated attackers with high privileges to circumvent IP-based deny rules. This vulnerability could enable attackers to access restricted resources or bypass network-level security controls. No patch is currently available.
Earlier versions of this analysis (1)
Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12. [CVSS 7.6 HIGH]
RemediationAI
Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Classified as CWE-863 (Incorrect Authorization). Affects the virtual gateway component of Devolutions Server. Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.
Know when Devolutions Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.
Executive ViewAI
CVE-2026-1007 presents notable security risk, a incorrect authorization vulnerability rated CVSS 7.6. Attackers could bypass security controls to gain unauthorized access to protected resources and sensitive data. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
More in Devolutions Server
View allInput validation flaw in Devolutions Server error message page enables remote spoofing attacks.
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
Devolutions Server 2025.3.1 through 2025.3.6 contains a SQL injection vulnerability in the remote sessions component tha
Behavioral control bypass in Devolutions Server 2025.3.15 allows authenticated users to exploit delete permissions.
Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated u
An issue was discovered in Devolutions Server before 2020.3. Rated critical severity (CVSS 9.1), this vulnerability is r
Authenticated privilege escalation in Devolutions Server 2025.2.12.0 and earlier lets any holder of a basic (low-privile
Devolutions Server 2025.3.2 and earlier fails to properly validate certificates when connecting to gateways, letting an
Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group member
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated
SQL Injection vulnerability in last usage logs in Devolutions Server.2.20, through 2025.3.8. Rated high severity (CVSS 8
Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access t
GitHub PoC
Exploit-DB