173
CVEs
12
Critical
49
High
0
KEV
0
PoC
51
Unpatched C/H
13.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
12
HIGH
49
MEDIUM
98
LOW
14
Monthly CVE Trend
Affected Products (17)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-3204 | Input validation flaw in Devolutions Server error message page enables remote spoofing attacks. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-2590 | Insecure password saving enforcement in Devolutions Remote Desktop Manager 2025.3. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-3224 | Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-0610 | Devolutions Server 2025.3.1 through 2025.3.6 contains a SQL injection vulnerability in the remote sessions component that allows attackers to manipulate database queries. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-3130 | Behavioral control bypass in Devolutions Server 2025.3.15 allows authenticated users to exploit delete permissions. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2023-4373 | Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.7% | 49 |
No patch
|
| CVE-2023-5765 | Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to bypass permissions via data source switching. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2023-5766 | A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute code from another windows user session on the same host via a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.6% | 49 |
No patch
|
| CVE-2023-6593 | Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to the application to execute entries in a SQL data source without. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.7% | 49 |
No patch
|
| CVE-2024-2921 | Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entries via a specific. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.8% | 49 |
No patch
|
| CVE-2024-6057 | Improper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allows an attacker that has compromised an access to an RDM instance to bypass the. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.8 | 0.9% | 49 |
No patch
|
| CVE-2021-23921 | An issue was discovered in Devolutions Server before 2020.3. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.1 | 1.0% | 46 |
No patch
|
| CVE-2026-16800 | Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%). | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-16801 | Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-14536 | Multi-factor authentication bypass in Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 lets an attacker who already holds valid user credentials authenticate without completing MFA, defeating an enforced 'MFA Required' policy. The flaw triggers when DVLS encounters an invalid default MFA value, causing the mandatory second factor to be skipped. It is vendor-reported with a patch available; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile). | HIGH | 8.8 | 0.2% | 44 |
|