What is the CVSS score of CVE-2026-3130?

CVE-2026-3130 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Devolutions Server are affected by CVE-2026-3130?

Devolutions Server 2025.3.15 and earlier contain a critical vulnerability that allows authenticated users to delete privileged access management (PAM) accounts currently in use by other personnel…

How to fix or mitigate CVE-2026-3130?

Within 24 hours: Audit all PAM account deletions in Devolutions Server logs to identify unauthorized removals and notify affected teams. Restrict bulk deletion permissions to system administrators only and disable bulk operations if possible. Within 7 days: Conduct full access review of delete permissions across all user accounts and implement principle of least privilege. Within 30 days: Develop and test migration plan to upgrade to patched version when released; establish monitoring for suspicious deletion patterns and implement approval workflow for PAM account deletions.

Devolutions Server CVE-2026-3130

CRITICAL

Improper Enforcement of Behavioral Workflow (CWE-841)

2026-03-03 security@devolutions.net

Information Disclosure Devolutions Server

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 03, 2026 - 22:16 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.