73
CVEs
5
Critical
20
High
0
KEV
0
PoC
15
Unpatched C/H
31.5%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
20
MEDIUM
39
LOW
9
Monthly CVE Trend
Affected Products (17)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-3204 | Input validation flaw in Devolutions Server error message page enables remote spoofing attacks. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-2590 | Insecure password saving enforcement in Devolutions Remote Desktop Manager 2025.3. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-3224 | Azure AD auth bypass in Devolutions Server 2025.3.15.0 and earlier. | CRITICAL | 9.8 | 0.1% | 49 |
No patch
|
| CVE-2026-0610 | Devolutions Server 2025.3.1 through 2025.3.6 contains a SQL injection vulnerability in the remote sessions component that allows attackers to manipulate database queries. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-3130 | Behavioral control bypass in Devolutions Server 2025.3.15 allows authenticated users to exploit delete permissions. | CRITICAL | 9.8 | 0.0% | 49 |
No patch
|
| CVE-2026-16800 | Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%). | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-16801 | Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3. | HIGH | 8.8 | 0.3% | 44 |
|
| CVE-2026-14536 | Multi-factor authentication bypass in Devolutions Server (DVLS) versions 2026.2.4 through 2026.2.8 lets an attacker who already holds valid user credentials authenticate without completing MFA, defeating an enforced 'MFA Required' policy. The flaw triggers when DVLS encounters an invalid default MFA value, causing the mandatory second factor to be skipped. It is vendor-reported with a patch available; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 8th percentile). | HIGH | 8.8 | 0.2% | 44 |
|
| CVE-2026-12161 | OS command injection in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager up to 2026.2.7 lets an authenticated user who can create or modify a shared SSH entry execute arbitrary commands on remote SSH hosts by smuggling shell metacharacters through a crafted alternate username, abusing stored elevation credentials they would not otherwise possess. No public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), but the privilege-escalation angle - turning shared-entry write access into code execution under another user's sudo/elevation context - makes this attractive for insider or post-compromise abuse. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-17568 | Privilege escalation in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to elevate to administrator via a crafted API request. Affected versions include 2026.2.4.0 through 2026.2.12.0 and 2026.1.23.0 and earlier; fixed releases 2026.2.14 and 2026.1.24 are available. No active exploitation or public exploit code has been reported, and EPSS indicates low exploitation probability (0.13%). | HIGH | 8.8 | 0.1% | 44 |
|
| CVE-2025-13757 | SQL Injection vulnerability in last usage logs in Devolutions Server.2.20, through 2025.3.8. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2026-4064 | PowerShell Universal before version 2026.1.4 contains insufficient authorization validation on gRPC endpoints, allowing any authenticated user to bypass role-based access controls and execute privileged operations. An attacker with valid credentials can exploit this to read sensitive data, modify or delete resources, and disrupt service availability. No patch is currently available. | HIGH | 8.3 | 0.0% | 42 |
|
| CVE-2026-4828 | Devolutions Server versions 2026.1.11 and earlier allow authenticated remote attackers to bypass multi-factor authentication through improper validation of OAuth login requests, enabling account takeover without second-factor verification. CISA KEV status and exploit availability not confirmed at time of analysis. | HIGH | 8.2 | 0.0% | 41 |
No patch
|
| CVE-2026-4924 | Devolutions Server 2026.1.11 and earlier allows authenticated remote attackers to bypass two-factor authentication by reusing a partially authenticated session token, enabling unauthorized account access without completing the second authentication factor. The vulnerability affects all versions up to and including 2026.1.11, with no CVSS score or public exploit confirmation available at analysis time. | HIGH | 8.2 | 0.0% | 41 |
No patch
|
| CVE-2026-4434 | Devolutions Server contains an improper certificate validation vulnerability in its PAM propagation WinRM connections that allows network attackers to conduct man-in-the-middle (MITM) attacks by exploiting disabled TLS certificate verification. This vulnerability affects Devolutions Server versions prior to 2026.1, enabling attackers positioned on the network path to intercept and manipulate WinRM communications without detection. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and carries significant information disclosure and server compromise risks, particularly in environments where PAM propagation relies on WinRM for credential delivery and privileged session management. | HIGH | 8.1 | 0.0% | 41 |
|