Devolutions
Monthly
Intercepted VNC sessions in Devolutions Remote Desktop Manager are possible because the IronVNC client automatically accepts the server's RSA key without verification during RSA-AES authentication, leaving an on-path attacker able to substitute their own key and relay tampered traffic. Both the 2026.2.x branch (up to 2026.2.17.0) and the 2026.1.x branch (up to 2026.1.24.0) are affected. No public exploit exists and EPSS sits at 0.11% (1st percentile), but the attack requires only network positioning and a user-initiated VNC session, making it a realistic threat on untrusted or adversary-adjacent networks.
Man-in-the-middle interception in Devolutions Password Manager (version 2026.2.1.0 and earlier on Android, iOS, and macOS) stems from improper TLS certificate validation when the mobile/desktop client connects to a Devolutions Server. An adjacent-network attacker presenting a forged certificate can silently intercept and modify the sensitive vault/session traffic between client and server. No public exploit is identified at time of analysis, and CISA SSVC scores exploitation as 'none,' though the technical impact is rated total.
Disclosure of plaintext credential secrets in Devolutions Server allows authenticated low-privileged users to access PAM password history entries via crafted API requests. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier, with vendor patches released (DEVO-2026-0026). No active exploitation or public exploit code has been identified at time of analysis.
Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier contain an improper access control flaw in the NetBox synchronizer that allows an authenticated user with view-only permissions to retrieve a stored API token. No active exploitation or public exploit code has been reported; EPSS indicates a 0.13% probability of exploitation, making mass targeting unlikely. The vulnerability is rated Medium severity with a CVSS base score of 4.3.
Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to elevate to administrator via a crafted API request. Affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier; fixed releases 2026.2.14 and 2026.1.24 are available. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability (0.13%).
Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system access to read secret variable values stored in cleartext on disk. This occurs when the variables feature is used without selecting a vault for encryption. The vulnerability is not known to be actively exploited, and EPSS indicates a very low exploitation probability (0.08%).
Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3.
Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%).
Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with the Reader role to execute automation tests and modify workflow properties due to missing server-side authorization checks. This results in privilege escalation to perform restricted operations, though the EPSS exploitation probability is low (0.15%) and no active
OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with scoped job or script read permission to extract other users' stored refresh tokens from job read API responses. The automation jobs API fails to strip the token before sending it to the client. No active exploitation is reported; EPSS score is low at 0.22%.
Improper authorization in Devolutions Server's secure messages deletion endpoint exposes an Insecure Direct Object Reference (IDOR) flaw allowing any authenticated user to permanently delete secure messages belonging to other users simply by supplying a target message identifier. Affected versions are 2026.2.11 and 2026.1.22; patched releases 2026.1.23 and 2026.2.12 are available per the vendor advisory. No public exploit identified at time of analysis, and the low CVSS score of 3.1 reflects constrained impact (integrity only, no data disclosure) paired with high attack complexity.
Devolutions Server 2026.1.22.0 and 2026.2.11.0 exposes Azure Key Vault client secrets in cleartext within Recovery Kit response files, defeating an explicit 'exclude sensitive data' option that administrators rely on. Any party who obtains a copy of the generated response file can trivially read the credential without any decryption or tooling. No public exploit code exists and the vulnerability is not in CISA KEV; however, because successful exploitation yields a reusable cloud credential, the downstream blast radius in Azure environments substantially exceeds what the 3.3 CVSS base score suggests. A vendor-released patch is available.
Authorization bypass in Devolutions Server 2026.2.11 and 2026.1.22 lets an authenticated low-privileged user approve their own pending access request by calling the access request status endpoint directly, bypassing the mandatory approver review. Because access requests gate elevated access to protected resources, this effectively grants unauthorized privileged access (CVSS 7.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the issue was disclosed and patched by the vendor.
Sensitive information disclosure in Devolutions Server 2026.1.x and 2026.2.x lets an authenticated low-privileged user read the private keys of SSH key and certificate PAM credentials belonging to other users. By supplying a credential identifier they should not have access to (an insecure direct object reference), the attacker retrieves secrets the PAM module is supposed to protect. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch is available. Note: the supplied CVSS vector lists PR:N (unauthenticated) while the description explicitly requires an authenticated low-privileged user — treat this as an authenticated IDOR.
Multi-factor authentication bypass in Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 lets an attacker who already holds valid user credentials authenticate without completing MFA, defeating an enforced 'MFA Required' policy. The flaw triggers when DVLS encounters an invalid default MFA value, causing the mandatory second factor to be skipped. It is vendor-reported with a patch available; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile).
Devolutions PowerShell Universal 2026.2.0 leaks serialized App Tokens in plaintext within AI Agent job API responses, enabling authenticated privilege escalation through token theft and replay. An authenticated user holding only AI Agent read access - a lower-privileged role - can extract reusable App Tokens that may carry significantly higher privileges than their own account, effectively bypassing the intended access control boundary. No public exploit code exists and CISA has not listed this in KEV, but the CVSS C:H rating reflects that successful exploitation yields credentials reusable across the platform.
Privilege/context escalation in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 lets an authenticated user with write access to a shared workspace plant a custom PowerShell VPN editor entry whose display name collides with an existing VPN script link, causing the attacker's PowerShell to run in another user's context when that link is resolved. The flaw stems from incorrect link resolution by display name (CWE-706) rather than a stable identifier, yielding total compromise of the victim's session (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not in CISA KEV; a vendor patch is available.
NTLM credential coercion in Devolutions Server 2026.2.4.0 through 2026.2.6.x allows an authenticated user with the UserGroupsView permission to redirect PAM Active Directory discovery requests to an attacker-controlled host, capturing PAM provider service account credentials as NTLMv2 challenge-response hashes. The vulnerability exists within the PAM AD discovery endpoints and is triggered by supplying a crafted DomainName parameter that causes the server to initiate an outbound NTLM authentication handshake. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS is 0.22% (12th percentile), indicating very low current exploitation probability.
Arbitrary installer execution in Devolutions UniGetUI 2026.2.0 and earlier lets a WinGet community catalog contributor hijack a user's software update: because the pinget backend correlates installed applications to catalog packages by loose name-substring matching, an attacker can publish a crafted community package whose normalized name is a substring of a legitimate installed app's name, causing UniGetUI to offer and - when the user accepts - run the attacker's installer. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), consistent with the fact that success requires a matching installed application and the victim actively applying the malicious update.
Improper access control in Devolutions Server allows authenticated low-privilege users to read restricted attachments by exploiting a folder duplication feature that incorrectly inherits permissions without re-validating authorization on the duplicated content. Versions prior to 2026.1.21 (1.x branch) and 2026.2.5 (2.x branch) are confirmed affected per the vendor advisory DEVO-2026-0017. Exploitation requires an existing authenticated account; no public exploit exists and SSVC assessment indicates no active exploitation, making this a medium-priority remediation rather than an emergency response.
Improper access control in Devolutions Server 2026.2.x exposes social login entry metadata to authenticated vault members who lack authorization to view it. By sending crafted API requests to the social login connection endpoint, a low-privileged vault member can enumerate metadata - such as identity provider configurations and connection identifiers - belonging to vaults or entries outside their permitted scope. No active exploitation has been identified (SSVC: none, EPSS: 0.14%), and the vendor-released patch in version 2026.2.5 is available; risk is most meaningful in multi-tenant or strictly segmented vault deployments.
Improper access control in Devolutions Server's PAM account discovery module allows any authenticated low-privilege user to retrieve privileged account discovery scan results they are not authorized to view. Two maintenance branches are affected - versions prior to 2026.2.5 and 2026.1.21 - with vendor-released patches available via Devolutions advisory DEVO-2026-0017. No public exploit exists and EPSS sits at 0.14% (4th percentile), but the sensitivity of PAM account inventories in enterprise environments elevates the real-world impact beyond what the CVSS Medium rating alone conveys.
Credential disclosure in Devolutions Remote Desktop Manager versions 2026.2.0 through 2026.2.8 allows a low-privileged attacker to capture stored social login credentials by creating a crafted web entry targeting a provider lookalike domain. The social login autofill feature fails to properly validate the target host against the legitimate OAuth or social identity provider domain, causing stored credentials to be submitted to an attacker-controlled site when the victim user opens the malicious entry. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
OS command injection in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager up to 2026.2.7 lets an authenticated user who can create or modify a shared SSH entry execute arbitrary commands on remote SSH hosts by smuggling shell metacharacters through a crafted alternate username, abusing stored elevation credentials they would not otherwise possess. No public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), but the privilege-escalation angle - turning shared-entry write access into code execution under another user's sudo/elevation context - makes this attractive for insider or post-compromise abuse.
Unauthenticated remote access to user-defined REST endpoint OpenAPI specifications is possible in Devolutions PowerShell Universal 2026.1.7 and earlier due to improper access control (CWE-306). Any network-reachable attacker without credentials can retrieve the full OpenAPI specification of internally defined REST APIs, exposing endpoint paths, parameters, and operational structure that administrators intended to be non-public. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the low-complexity, zero-authentication network vector makes enumeration trivially automatable.
Command injection (CWE-78) in Devolutions Server's built-in PAM provider password rotation templates allows an attacker with vault write access to execute arbitrary OS commands on systems managed by the affected PAM provider. Affected versions include 2026.2.4.0 and all releases at or below 2026.1.20.0, reported directly by the vendor Devolutions. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the high-value nature of a PAM platform managing privileged credentials on downstream systems means the practical blast radius substantially exceeds what the CVSS C:L/I:L scores suggest.
Missing authorization on the deleted user groups API in Devolutions Server enables authenticated low-privileged users to enumerate metadata of deleted user groups via crafted API requests, bypassing intended access controls. Affected deployments include versions 2026.2.4.0 and 2026.1.20.0 and earlier, as confirmed by the vendor advisory DEVO-2026-0015. No public exploit exists and CISA SSVC confirms no active exploitation, placing this at low operational priority despite its network-accessible attack vector.
Cleartext credential exposure in Devolutions Server allows an authenticated low-privileged user to retrieve plaintext credentials stored for configured ticketing integrations via a crafted API request. Affected versions include Devolutions Server 2026.2.4.0 and all 2026.1.x releases up to and including 2026.1.20.0. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-disclosed by Devolutions via advisory DEVO-2026-0015.
Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated low-privilege user to delete PAM network discovery scan configurations that should be restricted to administrators. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only a valid low-privilege account over the network with no user interaction. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated user holding entry edit privileges to modify asset information beyond their authorized scope, bypassing the permission validation layer. The flaw resides in the permission validation component and enables privilege overreach within the platform's access control model - an authenticated low-privilege user can alter data they should have no write access to. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Credential disclosure in Devolutions Server (2026.1.6.0-2026.1.16.0 and 2025.3.20.0 and earlier) lets a low-privileged authenticated user coerce the server's Active Directory browsing feature into authenticating against an attacker-controlled host, relaying the stored PAM provider service-account credentials. Classified as SSRF (CWE-918), it enables theft of privileged service-account authentication material that can then be abused against downstream systems. No public exploit identified at time of analysis; EPSS is very low (0.04%, 11th percentile) and CISA SSVC rates exploitation as none.
Authorization bypass in Devolutions Server's entry status management feature allows authenticated non-administrator users to circumvent an administrator-enforced Pending Approval workflow, gaining unauthorized access to protected entry data through a crafted status change request. Affected versions span the entire 2025.3.x line through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 to 2026.1.16.0, as confirmed by Devolutions advisory DEVO-2026-0013. No public exploit has been identified and EPSS sits at 0.03% (7th percentile), indicating negligible observed exploitation activity; SSVC corroborates no known exploitation at time of analysis.
Devolutions Server's entry activity log feature fails to enforce per-permission authorization on its API layer, allowing authenticated users to retrieve audit trails for vault entries they can access but are explicitly denied log-viewing rights on. Affected are all Devolutions Server releases through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 through 2026.1.16.0. No public exploit code exists and EPSS sits at 0.03% (7th percentile), placing real-world exploitation risk firmly in the low tier despite the network-reachable attack vector.
Sealed-entry audit bypass in Devolutions Server allows an authenticated high-privileged user to silently retrieve sensitive data from protected vault entries without generating the expected unseal audit notification, undermining privileged access oversight controls. Affected versions span all releases through 2025.3.20.0 and the 2026.1.6.0 to 2026.1.16.0 range. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the compliance and insider-threat implications are significant in PAM environments where sealed-entry audit trails are the primary detection mechanism for sensitive credential access.
Improper access control in Devolutions Server exposes documentation and attachments of sealed vault entries to any authenticated user who holds vault read access. Sealed entries are an explicit security boundary intended to restrict access beyond standard vault permissions - this bypass undermines that control entirely via a crafted API request. No public exploit has been identified and SSVC indicates no known exploitation, but the attack requires only low-privilege authentication, making it accessible to any insider or compromised credential with vault read rights.
Missing authorization on the profile update API in Devolutions Server allows any authenticated Active Directory user to modify their own profile attributes beyond their permitted scope via a crafted API request. Affected are versions 2025.3.20.0 and earlier and 2026.1.6.0 through 2026.1.16.0. No public exploit has been identified and EPSS sits at 0.03% (8th percentile), but any AD-authenticated user with network reach to the API can tamper with profile data without additional privilege.
Unverified password change in Devolutions Server allows a low-privileged authenticated attacker to reset any user's account password by submitting a crafted request that omits or bypasses the current-password verification step. Affected are all releases up to and including 2025.3.20.0 and a specific 2026.1.x branch window (2026.1.6.0 through 2026.1.16.0), meaning the flaw spans both legacy and recent deployments of this enterprise PAM platform. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile) and SSVC exploitation status is confirmed as none, but the sensitivity of a PAM system as the target elevates real-world risk beyond the raw CVSS 3.1 score of 3.1.
Open redirect in Devolutions Server's external authentication provider flow allows unauthenticated remote attackers to redirect victims to attacker-controlled domains by embedding a crafted redirect parameter in a login link. Affected versions span 2026.1.6.0-2026.1.16.0 and all 2025.3.x releases through 2025.3.20.0, covering a significant window of recent deployments. No public exploit code exists and CISA KEV confirms no active exploitation, though the privileged-access-management context elevates the phishing risk beyond what the raw CVSS 5.0 score suggests.
Devolutions Server's entry export feature silently bypasses the unseal notification workflow when an authenticated, export-privileged user submits a crafted export request against a sealed entry. Sealed entries in Devolutions Server carry an explicit administrative oversight guarantee - unseal events trigger notifications to administrators - making this a control bypass against a core PAM audit promise rather than a direct credential theft. Affected versions span 2025.3.20.0 and earlier as well as 2026.1.6.0 through 2026.1.16.0; no public exploit exists and EPSS sits at 0.03% (8th percentile), reflecting no observed attacker interest at time of analysis.
Cross-vault authorization bypass in Devolutions Server's entry duplication feature permits an authenticated low-privilege user to exfiltrate documentation and attachments from vaults they cannot access by submitting a crafted save request with a foreign entry identifier. Two distinct version ranges are affected: all releases at or before 2025.3.20.0 and the 2026.1.6.0-2026.1.16.0 branch. EPSS stands at 0.03% (7th percentile), SSVC confirms no known exploitation, and no public exploit code has been identified, making this a low-urgency but meaningful finding for organizations relying on strict vault segregation within their PAM environment.
Missing authorization in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to bypass vault creation controls via a crafted import request. The flaw targets the vault import API endpoint, enabling unauthorized vault provisioning within a Privileged Access Management platform - a sensitive context where vault-level control can have downstream impact on managed credentials. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.03% (8th percentile) reflects minimal current exploitation likelihood.
Authentication bypass in Devolutions Server 2026.1.6.0 through 2026.1.16.0 lets an attacker who already knows a victim's password defeat that user's multi-factor authentication after the victim reconfigures their MFA factors, because factor key state is not properly reset. This is an authenticated (PR:L), user-interaction-dependent flaw (the victim must reconfigure factors) with total technical impact (full account takeover). It is not on CISA KEV and no public exploit identified at time of analysis; EPSS is very low at 0.05% (15th percentile).
Unauthenticated attackers can modify or delete arbitrary user notification records in Devolutions Server due to missing session validation in notification management endpoints. The vulnerability affects Devolutions Server 2025.3.19.0 and earlier, plus versions 2026.1.6.0 through 2026.1.15.0. CVSS 4.3 indicates low-to-moderate risk, but the EPSS percentile of 4% suggests this is not a high-priority target for automated exploitation despite the authentication bypass tag.
Missing authorization in the PAM module of Devolutions Server allows authenticated users with a PAM license to retrieve OTP secret keys and recovery codes without additional permissions, leading to account compromise through crafted API requests. Affected versions include Devolutions Server 2025.3.16.0 and earlier, plus 2026.1.6.0 through 2026.1.11.0. No public exploit code or active exploitation has been identified; however, the low CVSS score and minimal EPSS percentile suggest limited real-world attack incentive despite the confidentiality impact.
Authenticated attackers can read vault documentation from unauthorized vaults in Devolutions Server 2026.1.14.0 and earlier by sending a crafted API request that bypasses authorization checks on the vault documentation feature. The flaw stems from CWE-862 (Missing Authorization), where the server fails to verify that the requesting user has permission to access documentation tied to a specific vault. EPSS is 0.03% (8th percentile) and SSVC reports no known exploitation, indicating this is currently a theoretical risk with no observed active use.
Server-side request forgery (SSRF) in Devolutions Server gateway health check feature allows low-privileged authenticated users to bypass input validation and trigger arbitrary requests, potentially disclosing sensitive information from internal systems or network resources. Affected versions are 2026.1.1-2026.1.11 and 2025.3.1-2025.3.17. No public exploit code or active exploitation has been confirmed at time of analysis.
Improper access control in Devolutions Server 2026.1.6 through 2026.1.11 allows authenticated attackers to delete their own MFA factors via crafted API requests, reducing account protection to password-only authentication. This vulnerability enables account security degradation without proper authorization checks, potentially compromising accounts that rely on multi-factor authentication as a secondary defense.
Improper access control in Devolutions Server 2026.1.6 through 2026.1.11 allows authenticated users to bypass administrator-enforced MFA restrictions and remove their own multi-factor authentication via a crafted request. This authentication bypass undermines security policies designed to enforce MFA compliance, enabling threat actors with valid credentials to disable a critical security control and potentially maintain persistent access without secondary authentication verification. No public exploit code or active exploitation has been confirmed at time of analysis.
Devolutions Server versions 2026.1.6 through 2026.1.11 expose sensitive one-time password (OTP) keys in the MFA feature, allowing authenticated users with user management privileges to retrieve other users' OTP secrets via API requests. This information disclosure vulnerability enables account takeover by attackers who obtain valid credentials with user management roles, as OTP keys are sufficient to generate valid authentication codes and bypass multi-factor authentication protections.
Devolutions Server 2026.1.11 and earlier allows authenticated remote attackers to bypass two-factor authentication by reusing a partially authenticated session token, enabling unauthorized account access without completing the second authentication factor. The vulnerability affects all versions up to and including 2026.1.11, with no CVSS score or public exploit confirmation available at analysis time.
Devolutions Server versions 2026.1.11 and earlier allow authenticated remote attackers to bypass multi-factor authentication through improper validation of OAuth login requests, enabling account takeover without second-factor verification. CISA KEV status and exploit availability not confirmed at time of analysis.
Improper session code validation in Devolutions Server 2026.1.11 and earlier allows authenticated users to escalate privileges and impersonate other users, including administrators, by reusing session codes from external OAuth authentication flows. This authentication bypass affects all versions up to and including 2026.1.11 and requires an attacker to have valid credentials to exploit the vulnerability. No public exploit code or active exploitation has been confirmed at the time of analysis.
Devolutions Server contains an improper certificate validation vulnerability in its PAM propagation WinRM connections that allows network attackers to conduct man-in-the-middle (MITM) attacks by exploiting disabled TLS certificate verification. This vulnerability affects Devolutions Server versions prior to 2026.1, enabling attackers positioned on the network path to intercept and manipulate WinRM communications without detection. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and carries significant information disclosure and server compromise risks, particularly in environments where PAM propagation relies on WinRM for credential delivery and privileged session management.
Devolutions Hub Reporting Service versions 2025.3.1.1 and earlier contain improper certificate validation that disables TLS certificate verification, enabling network attackers to intercept and manipulate encrypted communications. An unauthenticated attacker on the network can conduct man-in-the-middle (MITM) attacks to eavesdrop on sensitive data exchanges or inject malicious content. While no CVSS score or EPSS probability is currently available, the vulnerability's classification under CWE-295 (Improper Certificate Validation) indicates a cryptographic bypass with potentially severe information disclosure implications.
PowerShell Universal versions before 2026.1.4 contain an improper input validation vulnerability in the apps and endpoints configuration system that allows authenticated users with creation or modification permissions to inject malicious URL paths that override existing application or system routes. This vulnerability can result in unintended request routing where legitimate traffic is redirected to attacker-controlled endpoints, as well as denial of service conditions through route conflicts. The vulnerability requires high-level authentication privileges (PR:H) but has been formally documented in the ENISA EUVD database (EUVD-2026-12636) and poses a real risk to multi-tenant PowerShell Universal deployments where administrative controls may not be strictly enforced.
PowerShell Universal before version 2026.1.4 contains insufficient authorization validation on gRPC endpoints, allowing any authenticated user to bypass role-based access controls and execute privileged operations. An attacker with valid credentials can exploit this to read sensitive data, modify or delete resources, and disrupt service availability. No patch is currently available.
Improper access control in Devolutions Server 2025.3.11.0 and earlier allows authenticated low-privileged users to restore deleted users and roles through crafted API requests, potentially enabling unauthorized account recovery and privilege escalation. Organizations running affected versions are at risk as attackers with basic authentication credentials can manipulate user and role restoration without proper authorization checks. No patch is currently available.
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
Input validation flaw in Devolutions Server error message page enables remote spoofing attacks.
Behavioral control bypass in Devolutions Server 2025.3.15 allows authenticated users to exploit delete permissions.
Insecure password saving enforcement in Devolutions Remote Desktop Manager 2025.3.
Devolutions Server 2025.3.14 and earlier stores sensitive user account information in plaintext within the database, enabling attackers with database access to extract this data without authentication. This vulnerability affects deployments where database security is compromised or where privileged users have malicious intent. No patch is currently available.
Devolutions Server 2025.3.14.0 and earlier contains insufficient access control in REST API endpoints that enables authenticated view-only users to retrieve sensitive connection data they should not access. An attacker with basic authentication credentials could exploit this to gain unauthorized visibility into protected connection information, compromising confidentiality without requiring user interaction or elevated privileges.
Devolutions Server before version 2025.3.15 contains a permission cache poisoning flaw that allows authenticated users to circumvent access controls and retrieve restricted entries. The vulnerability affects any system running the vulnerable version where an attacker with valid credentials can exploit improper permission validation to access data they should not be authorized to view. No patch is currently available to remediate this issue.
Devolutions Server versions 2025.3.1 through 2025.3.12 contain an authorization bypass in the virtual gateway component that allows authenticated attackers with high privileges to circumvent IP-based deny rules. This vulnerability could enable attackers to access restricted resources or bypass network-level security controls. No patch is currently available.
Devolutions Server 2025.3.1 through 2025.3.6 contains a SQL injection vulnerability in the remote sessions component that allows attackers to manipulate database queries.
Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing. [CVSS 3.3 LOW]
Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.3.8.0; Remote Desktop Manager: through 2025.3.23.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of email service credentials to users without administrative rights in Devolutions Server.2.21, before 2025.3.9. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of credentials in unintended requests in Devolutions Server.2.20, through 2025.3.8. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL Injection vulnerability in last usage logs in Devolutions Server.2.20, through 2025.3.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure.3.2.0 through. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA.
Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feature when the Devolutions hosted endpoint is not reachable.
Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation.
Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorized groups by exploiting a user interface issue.1.3.0 through. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions.1.3.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration different from the one mandated by the. Rated low severity (CVSS 3.6). No vendor patch available.
Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser extension restriction feature. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Intercepted VNC sessions in Devolutions Remote Desktop Manager are possible because the IronVNC client automatically accepts the server's RSA key without verification during RSA-AES authentication, leaving an on-path attacker able to substitute their own key and relay tampered traffic. Both the 2026.2.x branch (up to 2026.2.17.0) and the 2026.1.x branch (up to 2026.1.24.0) are affected. No public exploit exists and EPSS sits at 0.11% (1st percentile), but the attack requires only network positioning and a user-initiated VNC session, making it a realistic threat on untrusted or adversary-adjacent networks.
Man-in-the-middle interception in Devolutions Password Manager (version 2026.2.1.0 and earlier on Android, iOS, and macOS) stems from improper TLS certificate validation when the mobile/desktop client connects to a Devolutions Server. An adjacent-network attacker presenting a forged certificate can silently intercept and modify the sensitive vault/session traffic between client and server. No public exploit is identified at time of analysis, and CISA SSVC scores exploitation as 'none,' though the technical impact is rated total.
Disclosure of plaintext credential secrets in Devolutions Server allows authenticated low-privileged users to access PAM password history entries via crafted API requests. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier, with vendor patches released (DEVO-2026-0026). No active exploitation or public exploit code has been identified at time of analysis.
Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier contain an improper access control flaw in the NetBox synchronizer that allows an authenticated user with view-only permissions to retrieve a stored API token. No active exploitation or public exploit code has been reported; EPSS indicates a 0.13% probability of exploitation, making mass targeting unlikely. The vulnerability is rated Medium severity with a CVSS base score of 4.3.
Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to elevate to administrator via a crafted API request. Affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier; fixed releases 2026.2.14 and 2026.1.24 are available. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability (0.13%).
Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system access to read secret variable values stored in cleartext on disk. This occurs when the variables feature is used without selecting a vault for encryption. The vulnerability is not known to be actively exploited, and EPSS indicates a very low exploitation probability (0.08%).
Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3.
Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%).
Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with the Reader role to execute automation tests and modify workflow properties due to missing server-side authorization checks. This results in privilege escalation to perform restricted operations, though the EPSS exploitation probability is low (0.15%) and no active
OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with scoped job or script read permission to extract other users' stored refresh tokens from job read API responses. The automation jobs API fails to strip the token before sending it to the client. No active exploitation is reported; EPSS score is low at 0.22%.
Improper authorization in Devolutions Server's secure messages deletion endpoint exposes an Insecure Direct Object Reference (IDOR) flaw allowing any authenticated user to permanently delete secure messages belonging to other users simply by supplying a target message identifier. Affected versions are 2026.2.11 and 2026.1.22; patched releases 2026.1.23 and 2026.2.12 are available per the vendor advisory. No public exploit identified at time of analysis, and the low CVSS score of 3.1 reflects constrained impact (integrity only, no data disclosure) paired with high attack complexity.
Devolutions Server 2026.1.22.0 and 2026.2.11.0 exposes Azure Key Vault client secrets in cleartext within Recovery Kit response files, defeating an explicit 'exclude sensitive data' option that administrators rely on. Any party who obtains a copy of the generated response file can trivially read the credential without any decryption or tooling. No public exploit code exists and the vulnerability is not in CISA KEV; however, because successful exploitation yields a reusable cloud credential, the downstream blast radius in Azure environments substantially exceeds what the 3.3 CVSS base score suggests. A vendor-released patch is available.
Authorization bypass in Devolutions Server 2026.2.11 and 2026.1.22 lets an authenticated low-privileged user approve their own pending access request by calling the access request status endpoint directly, bypassing the mandatory approver review. Because access requests gate elevated access to protected resources, this effectively grants unauthorized privileged access (CVSS 7.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the issue was disclosed and patched by the vendor.
Sensitive information disclosure in Devolutions Server 2026.1.x and 2026.2.x lets an authenticated low-privileged user read the private keys of SSH key and certificate PAM credentials belonging to other users. By supplying a credential identifier they should not have access to (an insecure direct object reference), the attacker retrieves secrets the PAM module is supposed to protect. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch is available. Note: the supplied CVSS vector lists PR:N (unauthenticated) while the description explicitly requires an authenticated low-privileged user — treat this as an authenticated IDOR.
Multi-factor authentication bypass in Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 lets an attacker who already holds valid user credentials authenticate without completing MFA, defeating an enforced 'MFA Required' policy. The flaw triggers when DVLS encounters an invalid default MFA value, causing the mandatory second factor to be skipped. It is vendor-reported with a patch available; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile).
Devolutions PowerShell Universal 2026.2.0 leaks serialized App Tokens in plaintext within AI Agent job API responses, enabling authenticated privilege escalation through token theft and replay. An authenticated user holding only AI Agent read access - a lower-privileged role - can extract reusable App Tokens that may carry significantly higher privileges than their own account, effectively bypassing the intended access control boundary. No public exploit code exists and CISA has not listed this in KEV, but the CVSS C:H rating reflects that successful exploitation yields credentials reusable across the platform.
Privilege/context escalation in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 lets an authenticated user with write access to a shared workspace plant a custom PowerShell VPN editor entry whose display name collides with an existing VPN script link, causing the attacker's PowerShell to run in another user's context when that link is resolved. The flaw stems from incorrect link resolution by display name (CWE-706) rather than a stable identifier, yielding total compromise of the victim's session (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not in CISA KEV; a vendor patch is available.
NTLM credential coercion in Devolutions Server 2026.2.4.0 through 2026.2.6.x allows an authenticated user with the UserGroupsView permission to redirect PAM Active Directory discovery requests to an attacker-controlled host, capturing PAM provider service account credentials as NTLMv2 challenge-response hashes. The vulnerability exists within the PAM AD discovery endpoints and is triggered by supplying a crafted DomainName parameter that causes the server to initiate an outbound NTLM authentication handshake. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS is 0.22% (12th percentile), indicating very low current exploitation probability.
Arbitrary installer execution in Devolutions UniGetUI 2026.2.0 and earlier lets a WinGet community catalog contributor hijack a user's software update: because the pinget backend correlates installed applications to catalog packages by loose name-substring matching, an attacker can publish a crafted community package whose normalized name is a substring of a legitimate installed app's name, causing UniGetUI to offer and - when the user accepts - run the attacker's installer. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), consistent with the fact that success requires a matching installed application and the victim actively applying the malicious update.
Improper access control in Devolutions Server allows authenticated low-privilege users to read restricted attachments by exploiting a folder duplication feature that incorrectly inherits permissions without re-validating authorization on the duplicated content. Versions prior to 2026.1.21 (1.x branch) and 2026.2.5 (2.x branch) are confirmed affected per the vendor advisory DEVO-2026-0017. Exploitation requires an existing authenticated account; no public exploit exists and SSVC assessment indicates no active exploitation, making this a medium-priority remediation rather than an emergency response.
Improper access control in Devolutions Server 2026.2.x exposes social login entry metadata to authenticated vault members who lack authorization to view it. By sending crafted API requests to the social login connection endpoint, a low-privileged vault member can enumerate metadata - such as identity provider configurations and connection identifiers - belonging to vaults or entries outside their permitted scope. No active exploitation has been identified (SSVC: none, EPSS: 0.14%), and the vendor-released patch in version 2026.2.5 is available; risk is most meaningful in multi-tenant or strictly segmented vault deployments.
Improper access control in Devolutions Server's PAM account discovery module allows any authenticated low-privilege user to retrieve privileged account discovery scan results they are not authorized to view. Two maintenance branches are affected - versions prior to 2026.2.5 and 2026.1.21 - with vendor-released patches available via Devolutions advisory DEVO-2026-0017. No public exploit exists and EPSS sits at 0.14% (4th percentile), but the sensitivity of PAM account inventories in enterprise environments elevates the real-world impact beyond what the CVSS Medium rating alone conveys.
Credential disclosure in Devolutions Remote Desktop Manager versions 2026.2.0 through 2026.2.8 allows a low-privileged attacker to capture stored social login credentials by creating a crafted web entry targeting a provider lookalike domain. The social login autofill feature fails to properly validate the target host against the legitimate OAuth or social identity provider domain, causing stored credentials to be submitted to an attacker-controlled site when the victim user opens the malicious entry. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
OS command injection in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager up to 2026.2.7 lets an authenticated user who can create or modify a shared SSH entry execute arbitrary commands on remote SSH hosts by smuggling shell metacharacters through a crafted alternate username, abusing stored elevation credentials they would not otherwise possess. No public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), but the privilege-escalation angle - turning shared-entry write access into code execution under another user's sudo/elevation context - makes this attractive for insider or post-compromise abuse.
Unauthenticated remote access to user-defined REST endpoint OpenAPI specifications is possible in Devolutions PowerShell Universal 2026.1.7 and earlier due to improper access control (CWE-306). Any network-reachable attacker without credentials can retrieve the full OpenAPI specification of internally defined REST APIs, exposing endpoint paths, parameters, and operational structure that administrators intended to be non-public. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the low-complexity, zero-authentication network vector makes enumeration trivially automatable.
Command injection (CWE-78) in Devolutions Server's built-in PAM provider password rotation templates allows an attacker with vault write access to execute arbitrary OS commands on systems managed by the affected PAM provider. Affected versions include 2026.2.4.0 and all releases at or below 2026.1.20.0, reported directly by the vendor Devolutions. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis, but the high-value nature of a PAM platform managing privileged credentials on downstream systems means the practical blast radius substantially exceeds what the CVSS C:L/I:L scores suggest.
Missing authorization on the deleted user groups API in Devolutions Server enables authenticated low-privileged users to enumerate metadata of deleted user groups via crafted API requests, bypassing intended access controls. Affected deployments include versions 2026.2.4.0 and 2026.1.20.0 and earlier, as confirmed by the vendor advisory DEVO-2026-0015. No public exploit exists and CISA SSVC confirms no active exploitation, placing this at low operational priority despite its network-accessible attack vector.
Cleartext credential exposure in Devolutions Server allows an authenticated low-privileged user to retrieve plaintext credentials stored for configured ticketing integrations via a crafted API request. Affected versions include Devolutions Server 2026.2.4.0 and all 2026.1.x releases up to and including 2026.1.20.0. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was self-disclosed by Devolutions via advisory DEVO-2026-0015.
Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated low-privilege user to delete PAM network discovery scan configurations that should be restricted to administrators. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms exploitation requires only a valid low-privilege account over the network with no user interaction. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Improper access control in Devolutions Server 2026.1.19 and earlier allows an authenticated user holding entry edit privileges to modify asset information beyond their authorized scope, bypassing the permission validation layer. The flaw resides in the permission validation component and enables privilege overreach within the platform's access control model - an authenticated low-privilege user can alter data they should have no write access to. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Credential disclosure in Devolutions Server (2026.1.6.0-2026.1.16.0 and 2025.3.20.0 and earlier) lets a low-privileged authenticated user coerce the server's Active Directory browsing feature into authenticating against an attacker-controlled host, relaying the stored PAM provider service-account credentials. Classified as SSRF (CWE-918), it enables theft of privileged service-account authentication material that can then be abused against downstream systems. No public exploit identified at time of analysis; EPSS is very low (0.04%, 11th percentile) and CISA SSVC rates exploitation as none.
Authorization bypass in Devolutions Server's entry status management feature allows authenticated non-administrator users to circumvent an administrator-enforced Pending Approval workflow, gaining unauthorized access to protected entry data through a crafted status change request. Affected versions span the entire 2025.3.x line through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 to 2026.1.16.0, as confirmed by Devolutions advisory DEVO-2026-0013. No public exploit has been identified and EPSS sits at 0.03% (7th percentile), indicating negligible observed exploitation activity; SSVC corroborates no known exploitation at time of analysis.
Devolutions Server's entry activity log feature fails to enforce per-permission authorization on its API layer, allowing authenticated users to retrieve audit trails for vault entries they can access but are explicitly denied log-viewing rights on. Affected are all Devolutions Server releases through 2025.3.20.0 and the 2026.1.x branch from 2026.1.6.0 through 2026.1.16.0. No public exploit code exists and EPSS sits at 0.03% (7th percentile), placing real-world exploitation risk firmly in the low tier despite the network-reachable attack vector.
Sealed-entry audit bypass in Devolutions Server allows an authenticated high-privileged user to silently retrieve sensitive data from protected vault entries without generating the expected unseal audit notification, undermining privileged access oversight controls. Affected versions span all releases through 2025.3.20.0 and the 2026.1.6.0 to 2026.1.16.0 range. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog, but the compliance and insider-threat implications are significant in PAM environments where sealed-entry audit trails are the primary detection mechanism for sensitive credential access.
Improper access control in Devolutions Server exposes documentation and attachments of sealed vault entries to any authenticated user who holds vault read access. Sealed entries are an explicit security boundary intended to restrict access beyond standard vault permissions - this bypass undermines that control entirely via a crafted API request. No public exploit has been identified and SSVC indicates no known exploitation, but the attack requires only low-privilege authentication, making it accessible to any insider or compromised credential with vault read rights.
Missing authorization on the profile update API in Devolutions Server allows any authenticated Active Directory user to modify their own profile attributes beyond their permitted scope via a crafted API request. Affected are versions 2025.3.20.0 and earlier and 2026.1.6.0 through 2026.1.16.0. No public exploit has been identified and EPSS sits at 0.03% (8th percentile), but any AD-authenticated user with network reach to the API can tamper with profile data without additional privilege.
Unverified password change in Devolutions Server allows a low-privileged authenticated attacker to reset any user's account password by submitting a crafted request that omits or bypasses the current-password verification step. Affected are all releases up to and including 2025.3.20.0 and a specific 2026.1.x branch window (2026.1.6.0 through 2026.1.16.0), meaning the flaw spans both legacy and recent deployments of this enterprise PAM platform. No public exploit or active exploitation has been identified; EPSS stands at 0.03% (8th percentile) and SSVC exploitation status is confirmed as none, but the sensitivity of a PAM system as the target elevates real-world risk beyond the raw CVSS 3.1 score of 3.1.
Open redirect in Devolutions Server's external authentication provider flow allows unauthenticated remote attackers to redirect victims to attacker-controlled domains by embedding a crafted redirect parameter in a login link. Affected versions span 2026.1.6.0-2026.1.16.0 and all 2025.3.x releases through 2025.3.20.0, covering a significant window of recent deployments. No public exploit code exists and CISA KEV confirms no active exploitation, though the privileged-access-management context elevates the phishing risk beyond what the raw CVSS 5.0 score suggests.
Devolutions Server's entry export feature silently bypasses the unseal notification workflow when an authenticated, export-privileged user submits a crafted export request against a sealed entry. Sealed entries in Devolutions Server carry an explicit administrative oversight guarantee - unseal events trigger notifications to administrators - making this a control bypass against a core PAM audit promise rather than a direct credential theft. Affected versions span 2025.3.20.0 and earlier as well as 2026.1.6.0 through 2026.1.16.0; no public exploit exists and EPSS sits at 0.03% (8th percentile), reflecting no observed attacker interest at time of analysis.
Cross-vault authorization bypass in Devolutions Server's entry duplication feature permits an authenticated low-privilege user to exfiltrate documentation and attachments from vaults they cannot access by submitting a crafted save request with a foreign entry identifier. Two distinct version ranges are affected: all releases at or before 2025.3.20.0 and the 2026.1.6.0-2026.1.16.0 branch. EPSS stands at 0.03% (7th percentile), SSVC confirms no known exploitation, and no public exploit code has been identified, making this a low-urgency but meaningful finding for organizations relying on strict vault segregation within their PAM environment.
Missing authorization in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to bypass vault creation controls via a crafted import request. The flaw targets the vault import API endpoint, enabling unauthorized vault provisioning within a Privileged Access Management platform - a sensitive context where vault-level control can have downstream impact on managed credentials. No public exploit code has been identified at time of analysis, and EPSS scoring at 0.03% (8th percentile) reflects minimal current exploitation likelihood.
Authentication bypass in Devolutions Server 2026.1.6.0 through 2026.1.16.0 lets an attacker who already knows a victim's password defeat that user's multi-factor authentication after the victim reconfigures their MFA factors, because factor key state is not properly reset. This is an authenticated (PR:L), user-interaction-dependent flaw (the victim must reconfigure factors) with total technical impact (full account takeover). It is not on CISA KEV and no public exploit identified at time of analysis; EPSS is very low at 0.05% (15th percentile).
Unauthenticated attackers can modify or delete arbitrary user notification records in Devolutions Server due to missing session validation in notification management endpoints. The vulnerability affects Devolutions Server 2025.3.19.0 and earlier, plus versions 2026.1.6.0 through 2026.1.15.0. CVSS 4.3 indicates low-to-moderate risk, but the EPSS percentile of 4% suggests this is not a high-priority target for automated exploitation despite the authentication bypass tag.
Missing authorization in the PAM module of Devolutions Server allows authenticated users with a PAM license to retrieve OTP secret keys and recovery codes without additional permissions, leading to account compromise through crafted API requests. Affected versions include Devolutions Server 2025.3.16.0 and earlier, plus 2026.1.6.0 through 2026.1.11.0. No public exploit code or active exploitation has been identified; however, the low CVSS score and minimal EPSS percentile suggest limited real-world attack incentive despite the confidentiality impact.
Authenticated attackers can read vault documentation from unauthorized vaults in Devolutions Server 2026.1.14.0 and earlier by sending a crafted API request that bypasses authorization checks on the vault documentation feature. The flaw stems from CWE-862 (Missing Authorization), where the server fails to verify that the requesting user has permission to access documentation tied to a specific vault. EPSS is 0.03% (8th percentile) and SSVC reports no known exploitation, indicating this is currently a theoretical risk with no observed active use.
Server-side request forgery (SSRF) in Devolutions Server gateway health check feature allows low-privileged authenticated users to bypass input validation and trigger arbitrary requests, potentially disclosing sensitive information from internal systems or network resources. Affected versions are 2026.1.1-2026.1.11 and 2025.3.1-2025.3.17. No public exploit code or active exploitation has been confirmed at time of analysis.
Improper access control in Devolutions Server 2026.1.6 through 2026.1.11 allows authenticated attackers to delete their own MFA factors via crafted API requests, reducing account protection to password-only authentication. This vulnerability enables account security degradation without proper authorization checks, potentially compromising accounts that rely on multi-factor authentication as a secondary defense.
Improper access control in Devolutions Server 2026.1.6 through 2026.1.11 allows authenticated users to bypass administrator-enforced MFA restrictions and remove their own multi-factor authentication via a crafted request. This authentication bypass undermines security policies designed to enforce MFA compliance, enabling threat actors with valid credentials to disable a critical security control and potentially maintain persistent access without secondary authentication verification. No public exploit code or active exploitation has been confirmed at time of analysis.
Devolutions Server versions 2026.1.6 through 2026.1.11 expose sensitive one-time password (OTP) keys in the MFA feature, allowing authenticated users with user management privileges to retrieve other users' OTP secrets via API requests. This information disclosure vulnerability enables account takeover by attackers who obtain valid credentials with user management roles, as OTP keys are sufficient to generate valid authentication codes and bypass multi-factor authentication protections.
Devolutions Server 2026.1.11 and earlier allows authenticated remote attackers to bypass two-factor authentication by reusing a partially authenticated session token, enabling unauthorized account access without completing the second authentication factor. The vulnerability affects all versions up to and including 2026.1.11, with no CVSS score or public exploit confirmation available at analysis time.
Devolutions Server versions 2026.1.11 and earlier allow authenticated remote attackers to bypass multi-factor authentication through improper validation of OAuth login requests, enabling account takeover without second-factor verification. CISA KEV status and exploit availability not confirmed at time of analysis.
Improper session code validation in Devolutions Server 2026.1.11 and earlier allows authenticated users to escalate privileges and impersonate other users, including administrators, by reusing session codes from external OAuth authentication flows. This authentication bypass affects all versions up to and including 2026.1.11 and requires an attacker to have valid credentials to exploit the vulnerability. No public exploit code or active exploitation has been confirmed at the time of analysis.
Devolutions Server contains an improper certificate validation vulnerability in its PAM propagation WinRM connections that allows network attackers to conduct man-in-the-middle (MITM) attacks by exploiting disabled TLS certificate verification. This vulnerability affects Devolutions Server versions prior to 2026.1, enabling attackers positioned on the network path to intercept and manipulate WinRM communications without detection. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and carries significant information disclosure and server compromise risks, particularly in environments where PAM propagation relies on WinRM for credential delivery and privileged session management.
Devolutions Hub Reporting Service versions 2025.3.1.1 and earlier contain improper certificate validation that disables TLS certificate verification, enabling network attackers to intercept and manipulate encrypted communications. An unauthenticated attacker on the network can conduct man-in-the-middle (MITM) attacks to eavesdrop on sensitive data exchanges or inject malicious content. While no CVSS score or EPSS probability is currently available, the vulnerability's classification under CWE-295 (Improper Certificate Validation) indicates a cryptographic bypass with potentially severe information disclosure implications.
PowerShell Universal versions before 2026.1.4 contain an improper input validation vulnerability in the apps and endpoints configuration system that allows authenticated users with creation or modification permissions to inject malicious URL paths that override existing application or system routes. This vulnerability can result in unintended request routing where legitimate traffic is redirected to attacker-controlled endpoints, as well as denial of service conditions through route conflicts. The vulnerability requires high-level authentication privileges (PR:H) but has been formally documented in the ENISA EUVD database (EUVD-2026-12636) and poses a real risk to multi-tenant PowerShell Universal deployments where administrative controls may not be strictly enforced.
PowerShell Universal before version 2026.1.4 contains insufficient authorization validation on gRPC endpoints, allowing any authenticated user to bypass role-based access controls and execute privileged operations. An attacker with valid credentials can exploit this to read sensitive data, modify or delete resources, and disrupt service availability. No patch is currently available.
Improper access control in Devolutions Server 2025.3.11.0 and earlier allows authenticated low-privileged users to restore deleted users and roles through crafted API requests, potentially enabling unauthorized account recovery and privilege escalation. Organizations running affected versions are at risk as attackers with basic authentication credentials can manipulate user and role restoration without proper authorization checks. No patch is currently available.
Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier.
Input validation flaw in Devolutions Server error message page enables remote spoofing attacks.
Behavioral control bypass in Devolutions Server 2025.3.15 allows authenticated users to exploit delete permissions.
Insecure password saving enforcement in Devolutions Remote Desktop Manager 2025.3.
Devolutions Server 2025.3.14 and earlier stores sensitive user account information in plaintext within the database, enabling attackers with database access to extract this data without authentication. This vulnerability affects deployments where database security is compromised or where privileged users have malicious intent. No patch is currently available.
Devolutions Server 2025.3.14.0 and earlier contains insufficient access control in REST API endpoints that enables authenticated view-only users to retrieve sensitive connection data they should not access. An attacker with basic authentication credentials could exploit this to gain unauthorized visibility into protected connection information, compromising confidentiality without requiring user interaction or elevated privileges.
Devolutions Server before version 2025.3.15 contains a permission cache poisoning flaw that allows authenticated users to circumvent access controls and retrieve restricted entries. The vulnerability affects any system running the vulnerable version where an attacker with valid credentials can exploit improper permission validation to access data they should not be authorized to view. No patch is currently available to remediate this issue.
Devolutions Server versions 2025.3.1 through 2025.3.12 contain an authorization bypass in the virtual gateway component that allows authenticated attackers with high privileges to circumvent IP-based deny rules. This vulnerability could enable attackers to access restricted resources or bypass network-level security controls. No patch is currently available.
Devolutions Server 2025.3.1 through 2025.3.6 contains a SQL injection vulnerability in the remote sessions component that allows attackers to manipulate database queries.
Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing. [CVSS 3.3 LOW]
Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.3.8.0; Remote Desktop Manager: through 2025.3.23.0. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of email service credentials to users without administrative rights in Devolutions Server.2.21, before 2025.3.9. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of credentials in unintended requests in Devolutions Server.2.20, through 2025.3.8. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
SQL Injection vulnerability in last usage logs in Devolutions Server.2.20, through 2025.3.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure.3.2.0 through. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change administrators MFA.
Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking feature when the Devolutions hosted endpoint is not reachable.
Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" permission by bypassing the client side validation.
Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Management" permissions to. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated user to gain unauthorized access to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorized groups by exploiting a user interface issue.1.3.0 through. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user interface actions.1.3.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD variable even though not allowed by the. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without generating a corresponding log event, via. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration different from the one mandated by the. Rated low severity (CVSS 3.6). No vendor patch available.
Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser extension restriction feature. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information about these. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing password masking. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows an authenticated user to. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user exporting a hub data source to include his. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.