What is the CVSS score of CVE-2026-3130?

CVE-2026-3130 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Devolutions Server are affected by CVE-2026-3130?

Devolutions Server 2025.3.15 and earlier contain a critical vulnerability that allows authenticated users to delete privileged access management (PAM) accounts currently in use by other personnel…

How to fix or mitigate CVE-2026-3130?

Within 24 hours: Audit all PAM account deletions in Devolutions Server logs to identify unauthorized removals and notify affected teams. Restrict bulk deletion permissions to system administrators only and disable bulk operations if possible. Within 7 days: Conduct full access review of delete permissions across all user accounts and implement principle of least privilege. Within 30 days: Develop and test migration plan to upgrade to patched version when released; establish monitoring for suspicious deletion patterns and implement approval workflow for PAM account deletions.

Devolutions Server CVE-2026-3130

CRITICAL

Improper Enforcement of Behavioral Workflow (CWE-841)

2026-03-03 security@devolutions.net

Information Disclosure Devolutions Server

9.8

CVSS 3.1

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 03, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionNVD

Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.

AnalysisAI

Behavioral control bypass in Devolutions Server 2025.3.15 allows authenticated users to exploit delete permissions.

RemediationAI

Within 24 hours: Audit all PAM account deletions in Devolutions Server logs to identify unauthorized removals and notify affected teams. Restrict bulk deletion permissions to system administrators only and disable bulk operations if possible. …

Analysis

Detailed AI-generated intelligence summary covering attack vector, impact assessment, affected versions, remediation steps, and indicators of compromise.

POChttps://••••••••••.com/exploit

PATCHhttps://••••••••••.com/patch

ADVISORYhttps://••••••••••.com/advisory

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

CVE-2026-3130 vulnerability details – vuln.today

Back

Devolutions Server CVE-2026-3130

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

RemediationAI

Full analysis requires sign-in

Share

External POC / Exploit Code