19
CVEs
0
Critical
9
High
0
KEV
0
PoC
1
Unpatched C/H
89.5%
Patch Rate
0.2%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
9
MEDIUM
7
LOW
3
Monthly CVE Trend
Affected Products (17)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-16800 | Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%). | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-16801 | Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-14536 | Multi-factor authentication bypass in Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 lets an attacker who already holds valid user credentials authenticate without completing MFA, defeating an enforced 'MFA Required' policy. The flaw triggers when DVLS encounters an invalid default MFA value, causing the mandatory second factor to be skipped. It is vendor-reported with a patch available; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile). | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-17568 | Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to elevate to administrator via a crafted API request. Affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier; fixed releases 2026.2.14 and 2026.1.24 are available. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability (0.13%). | HIGH | 8.8 | 0.1% | 44 |
|
| CVE-2026-10696 | Arbitrary installer execution in Devolutions UniGetUI 2026.2.0 and earlier lets a WinGet community catalog contributor hijack a user's software update: because the pinget backend correlates installed applications to catalog packages by loose name-substring matching, an attacker can publish a crafted community package whose normalized name is a substring of a legitimate installed app's name, causing UniGetUI to offer and - when the user accepts - run the attacker's installer. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), consistent with the fact that success requires a matching installed application and the victim actively applying the malicious update. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-15637 | Sensitive information disclosure in Devolutions Server 2026.1.x and 2026.2.x lets an authenticated low-privileged user read the private keys of SSH key and certificate PAM credentials belonging to other users. By supplying a credential identifier they should not have access to (an insecure direct object reference), the attacker retrieves secrets the PAM module is supposed to protect. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch is available. Note: the supplied CVSS vector lists PR:N (unauthenticated) while the description explicitly requires an authenticated low-privileged user — treat this as an authenticated IDOR. | HIGH | 7.5 | 0.1% | 38 |
|
| CVE-2026-8497 | Man-in-the-middle interception in Devolutions Password Manager (version 2026.2.1.0 and earlier on Android, iOS, and macOS) stems from improper TLS certificate validation when the mobile/desktop client connects to a Devolutions Server. An adjacent-network attacker presenting a forged certificate can silently intercept and modify the sensitive vault/session traffic between client and server. No public exploit is identified at time of analysis, and CISA SSVC scores exploitation as 'none,' though the technical impact is rated total. | HIGH | 7.4 | 0.1% | 37 |
|
| CVE-2026-13372 | Privilege/context escalation in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 lets an authenticated user with write access to a shared workspace plant a custom PowerShell VPN editor entry whose display name collides with an existing VPN script link, causing the attacker's PowerShell to run in another user's context when that link is resolved. The flaw stems from incorrect link resolution by display name (CWE-706) rather than a stable identifier, yielding total compromise of the victim's session (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not in CISA KEV; a vendor patch is available. | HIGH | 7.2 | 0.3% | 36 |
|
| CVE-2026-15641 | Authorization bypass in Devolutions Server 2026.2.11 and 2026.1.22 lets an authenticated low-privileged user approve their own pending access request by calling the access request status endpoint directly, bypassing the mandatory approver review. Because access requests gate elevated access to protected resources, this effectively grants unauthorized privileged access (CVSS 7.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the issue was disclosed and patched by the vendor. | HIGH | 7.1 | 0.1% | 36 |
|
| CVE-2026-13437 | Devolutions PowerShell Universal 2026.2.0 leaks serialized App Tokens in plaintext within AI Agent job API responses, enabling authenticated privilege escalation through token theft and replay. An authenticated user holding only AI Agent read access - a lower-privileged role - can extract reusable App Tokens that may carry significantly higher privileges than their own account, effectively bypassing the intended access control boundary. No public exploit code exists and CISA has not listed this in KEV, but the CVSS C:H rating reflects that successful exploitation yields credentials reusable across the platform. | MEDIUM | 6.5 | 0.2% | 33 |
No patch
|
| CVE-2026-16798 | OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with scoped job or script read permission to extract other users' stored refresh tokens from job read API responses. The automation jobs API fails to strip the token before sending it to the client. No active exploitation is reported; EPSS score is low at 0.22%. | MEDIUM | 6.5 | 0.2% | 33 |
|
| CVE-2026-16802 | Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system access to read secret variable values stored in cleartext on disk. This occurs when the variables feature is used without selecting a vault for encryption. The vulnerability is not known to be actively exploited, and EPSS indicates a very low exploitation probability (0.08%). | MEDIUM | 6.5 | 0.1% | 33 |
|
| CVE-2026-16799 | Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with the Reader role to execute automation tests and modify workflow properties due to missing server-side authorization checks. This results in privilege escalation to perform restricted operations, though the EPSS exploitation probability is low (0.15%) and no active | MEDIUM | 5.0 | 0.2% | 25 |
|
| CVE-2026-17570 | Disclosure of plaintext credential secrets in Devolutions Server allows authenticated low-privileged users to access PAM password history entries via crafted API requests. Affected versions are 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier, with vendor patches released (DEVO-2026-0026). No active exploitation or public exploit code has been identified at time of analysis. | MEDIUM | 4.3 | 0.2% | 22 |
|
| CVE-2026-17569 | Devolutions Server versions 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier contain an improper access control flaw in the NetBox synchronizer that allows an authenticated user with view-only permissions to retrieve a stored API token. No active exploitation or public exploit code has been reported; EPSS indicates a 0.13% probability of exploitation, making mass targeting unlikely. The vulnerability is rated Medium severity with a CVSS base score of 4.3. | MEDIUM | 4.3 | 0.1% | 22 |
|