53
CVEs
0
Critical
15
High
0
KEV
0
PoC
6
Unpatched C/H
39.6%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
15
MEDIUM
31
LOW
7
Monthly CVE Trend
Affected Products (17)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-16800 | Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%). | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-16801 | Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-14536 | Multi-factor authentication bypass in Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 lets an attacker who already holds valid user credentials authenticate without completing MFA, defeating an enforced 'MFA Required' policy. The flaw triggers when DVLS encounters an invalid default MFA value, causing the mandatory second factor to be skipped. It is vendor-reported with a patch available; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile). | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-12161 | OS command injection in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager up to 2026.2.7 lets an authenticated user who can create or modify a shared SSH entry execute arbitrary commands on remote SSH hosts by smuggling shell metacharacters through a crafted alternate username, abusing stored elevation credentials they would not otherwise possess. No public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), but the privilege-escalation angle - turning shared-entry write access into code execution under another user's sudo/elevation context - makes this attractive for insider or post-compromise abuse. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-17568 | Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to elevate to administrator via a crafted API request. Affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier; fixed releases 2026.2.14 and 2026.1.24 are available. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability (0.13%). | HIGH | 8.8 | 0.1% | 44 |
|
| CVE-2026-4828 | Devolutions Server versions 2026.1.11 and earlier allow authenticated remote attackers to bypass multi-factor authentication through improper validation of OAuth login requests, enabling account takeover without second-factor verification. CISA KEV status and exploit availability not confirmed at time of analysis. | HIGH | 8.2 | 0.0% | 41 |
No patch
|
| CVE-2026-4924 | Devolutions Server 2026.1.11 and earlier allows authenticated remote attackers to bypass two-factor authentication by reusing a partially authenticated session token, enabling unauthorized account access without completing the second authentication factor. The vulnerability affects all versions up to and including 2026.1.11, with no CVSS score or public exploit confirmation available at analysis time. | HIGH | 8.2 | 0.0% | 41 |
No patch
|
| CVE-2026-4434 | Devolutions Server contains an improper certificate validation vulnerability in its PAM propagation WinRM connections that allows network attackers to conduct man-in-the-middle (MITM) attacks by exploiting disabled TLS certificate verification. This vulnerability affects Devolutions Server versions prior to 2026.1, enabling attackers positioned on the network path to intercept and manipulate WinRM communications without detection. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and carries significant information disclosure and server compromise risks, particularly in environments where PAM propagation relies on WinRM for credential delivery and privileged session management. | HIGH | 8.1 | 0.0% | 41 |
|
| CVE-2026-9047 | Authentication bypass in Devolutions Server 2026.1.6.0 through 2026.1.16.0 lets an attacker who already knows a victim's password defeat that user's multi-factor authentication after the victim reconfigures their MFA factors, because factor key state is not properly reset. This is an authenticated (PR:L), user-interaction-dependent flaw (the victim must reconfigure factors) with total technical impact (full account takeover). It is not on CISA KEV and no public exploit identified at time of analysis; EPSS is very low at 0.05% (15th percentile). | HIGH | 7.6 | 0.0% | 38 |
No patch
|
| CVE-2026-10696 | Arbitrary installer execution in Devolutions UniGetUI 2026.2.0 and earlier lets a WinGet community catalog contributor hijack a user's software update: because the pinget backend correlates installed applications to catalog packages by loose name-substring matching, an attacker can publish a crafted community package whose normalized name is a substring of a legitimate installed app's name, causing UniGetUI to offer and - when the user accepts - run the attacker's installer. No public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.27% (18th percentile), consistent with the fact that success requires a matching installed application and the victim actively applying the malicious update. | HIGH | 7.5 | 0.3% | 38 |
No patch
|
| CVE-2026-15637 | Sensitive information disclosure in Devolutions Server 2026.1.x and 2026.2.x lets an authenticated low-privileged user read the private keys of SSH key and certificate PAM credentials belonging to other users. By supplying a credential identifier they should not have access to (an insecure direct object reference), the attacker retrieves secrets the PAM module is supposed to protect. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch is available. Note: the supplied CVSS vector lists PR:N (unauthenticated) while the description explicitly requires an authenticated low-privileged user — treat this as an authenticated IDOR. | HIGH | 7.5 | 0.1% | 38 |
|
| CVE-2026-8497 | Man-in-the-middle interception in Devolutions Password Manager (version 2026.2.1.0 and earlier on Android, iOS, and macOS) stems from improper TLS certificate validation when the mobile/desktop client connects to a Devolutions Server. An adjacent-network attacker presenting a forged certificate can silently intercept and modify the sensitive vault/session traffic between client and server. No public exploit is identified at time of analysis, and CISA SSVC scores exploitation as 'none,' though the technical impact is rated total. | HIGH | 7.4 | 0.1% | 37 |
|
| CVE-2026-13372 | Privilege/context escalation in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 lets an authenticated user with write access to a shared workspace plant a custom PowerShell VPN editor entry whose display name collides with an existing VPN script link, causing the attacker's PowerShell to run in another user's context when that link is resolved. The flaw stems from incorrect link resolution by display name (CWE-706) rather than a stable identifier, yielding total compromise of the victim's session (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not in CISA KEV; a vendor patch is available. | HIGH | 7.2 | 0.3% | 36 |
|
| CVE-2026-15641 | Authorization bypass in Devolutions Server 2026.2.11 and 2026.1.22 lets an authenticated low-privileged user approve their own pending access request by calling the access request status endpoint directly, bypassing the mandatory approver review. Because access requests gate elevated access to protected resources, this effectively grants unauthorized privileged access (CVSS 7.1). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the issue was disclosed and patched by the vendor. | HIGH | 7.1 | 0.1% | 36 |
|
| CVE-2026-7325 | Credential disclosure in Devolutions Server (2026.1.6.0-2026.1.16.0 and 2025.3.20.0 and earlier) lets a low-privileged authenticated user coerce the server's Active Directory browsing feature into authenticating against an attacker-controlled host, relaying the stored PAM provider service-account credentials. Classified as SSRF (CWE-918), it enables theft of privileged service-account authentication material that can then be abused against downstream systems. No public exploit identified at time of analysis; EPSS is very low (0.04%, 11th percentile) and CISA SSVC rates exploitation as none. | HIGH | 7.1 | 0.0% | 36 |
No patch
|