Devolutions

By the Year

In 2026 there have been 67 vulnerabilities in Devolutions with an average score of 6.1 out of ten. Last year, in 2025 Devolutions had 34 security vulnerabilities published. That is, 33 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.92

Recent Devolutions Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-19768	Aug 14, 2026	Code Injection via Settings in PowerShell Universal Pre-2026.2.4 Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.
CVE-2026-8497	Jul 29, 2026	Devolutions Manager <=2026.2.1.0 Improper Cert Validation on Mobile & macOS Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate.
CVE-2026-17570	Jul 27, 2026	Devolutions Serv 2026.2.412 Improper Access Control in PAM Pass Hist API Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via crafted API requests. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier
CVE-2026-17569	Jul 27, 2026	Devolutions Server 2026.2.412: Auth view users can read API token via sync API Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the partial connection endpoint. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier
CVE-2026-17568	Jul 27, 2026	Prv Escal via Role Member API in Devolutions Server 2026.2.412 Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 through 2026.2.12.0 * Devolutions Server 2026.1.23.0 and earlier
CVE-2026-16802	Jul 24, 2026	Cleartext Secret Storage in Variables (DPS PowerShell Universal < v2026.2.2) Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.
CVE-2026-16801	Jul 24, 2026	PowerShell Universal Variables: Code Injection <2026.2.2 Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file.
CVE-2026-16800	Jul 24, 2026	Code Injection in Devolutions PowerShell Universal 2026.2.2 (schedule feature) Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation.
CVE-2026-16799	Jul 24, 2026	Improper Access Control: Automation Tests/Workflows Devolutions PSU <2026.2.2 Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.
CVE-2026-16798	Jul 24, 2026	Sensitive Data Exposure via Job API in Devolutions PowerShell Universal <=2026.2 Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.
CVE-2026-15058	Jul 14, 2026	Devolutions Server 2026.2.11 Improper Auth: Delete Chat Messages Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.
CVE-2026-15642	Jul 14, 2026	Sensitive Data Leak in Devolutions Server 2026.1.22 via Recovery Kit Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.
CVE-2026-15641	Jul 14, 2026	Improper Auth: Devolutions Server 2026.2.11 request status endpoint Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review.
CVE-2026-15637	Jul 14, 2026	Devolutions Server 2026.2.11 & 2026.1.22: Improper Auth Reveals SSH Private Key Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.
CVE-2026-14536	Jul 06, 2026	Devolutions Server 2026.2.9.0 MFA Policy Bypass vulnerability Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.
CVE-2026-13437	Jun 29, 2026	Devolutions PowerShell Universal 2026.2.0 AI Agent job API Sensitive Data Exposure Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.
CVE-2026-13372	Jun 26, 2026	Remote Desktop Manager 2026.2.52026.2.11 PS VPN Editor Link Collision RCE Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link.	Remote Desktop Manager
CVE-2026-12755	Jun 25, 2026	Devolutions Server 2026.2.47.0 Improper PAM AD discovery: NTLMv2 creds leakage Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.
CVE-2026-10696	Jun 17, 2026	UniGetUI <2026.2.0 Pinget Backend Name Resolution Vulnerability Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update.
CVE-2026-12105	Jun 16, 2026	Devolutions Server 2026.2.5 Improper Access: Auth Users Access ATTACH via Dup Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.	Devolutions Server
CVE-2026-12117	Jun 16, 2026	Devolutions Server 2026.2.5 Improper Access Control via Social Login Endpoint Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.	Devolutions Server
CVE-2026-11890	Jun 16, 2026	Devolutions Server <2026.2.5 Improper Access Control in PAM Account Discovery Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.	Devolutions Server
CVE-2026-12162	Jun 15, 2026	Devolutions RDM 2026.2.8 Improper Host Validation in Social Login Autofill Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.	Remote Desktop Manager
CVE-2026-12161	Jun 15, 2026	RDM 2026.2.7 SSH Elevate Shell Auth'd Cmd Exec via Input Validation Flaw Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action. This affects  :  - Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0 - Remote Desktop Manager 2026.1.23.0 and earlier	Remote Desktop Manager
CVE-2026-8694	Jun 12, 2026	Devolutions PowerShell Universal 2026.1.7 Unauth Access OpenAPI Leak Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.
CVE-2026-10544	Jun 08, 2026	Devolutions Server <2026.2.4.0 PAM Provider Cmd Exec via Vault Write Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
CVE-2026-10787	Jun 08, 2026	Devolutions Server 2026.2.4.0 API No Auth: Deleted Group Meta Enum Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
CVE-2026-10786	Jun 08, 2026	IA: Devolutions Server 2026.2.4.0 Ticketing Settings Credential Leak Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
CVE-2026-9522	Jun 02, 2026	Devolutions Server 2026.1.19 and earlier: Access Control Flaw in PAM Discovery Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.
CVE-2026-9590	Jun 02, 2026	Devolutions Server <2026.1.19 Improper Access Control in Permission Validation Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission.
CVE-2026-7325	May 22, 2026	Improper Auth. in Devolutions Server AD Browsing (v2026.1.616) Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with a stored PAM provider service account via authentication relay to an attacker-controlled server. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9251	May 22, 2026	Devolutions Server 2026 Auth Bypass via Entry Status Management Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-5171	May 22, 2026	Devolutions Server 2026.1.16.0 Improper Access to Entry Activity Log via API Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to retrieve that entry's activity logs via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-8477	May 22, 2026	Devolutions Server 2026.1.6-2026.1.16: API sealed-entry bypass audit Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9246	May 22, 2026	Devolutions Server 2026 Improper Access in Entry Docs/API Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9224	May 22, 2026	Devolutions Server 2026.1.616.0 Missing Authorization in User Profile Update API Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9249	May 22, 2026	Devolutions Server 2026.1.6-2026.1.16 Unverified Password Change (CVE-2026-9249) Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9245	May 22, 2026	Devolutions Server 2026.1.6-16 Unauthenticated Redirect via External Auth Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9247	May 22, 2026	Devolutions Server: insufficient logging in export unseal bypass Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9248	May 22, 2026	Auth bypass in entry duplication (2026.1.6 - 2026.1.16) Devolutions Server Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9223	May 22, 2026	Missing Auth in Devolutions Server Vault Import (<2026.1.16.0) (CVE-2026-9223) Missing authorization in the vault import feature in Devolutions Server  2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request.
CVE-2026-9047	May 22, 2026	Devolutions Server 2026.1.6-16.0 MFA Bypass via Factor Key Misstate Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0
CVE-2026-5146	May 12, 2026	Devolutions Server 2025-2026 Improper Access Control in Notification Endpoints Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.15.0 * Devolutions Server 2025.3.19.0 and earlier
CVE-2026-8407	May 12, 2026	Devolutions Server PAM Auth Leak: OTP Secrets Exposed 2025.3.16-2026.1.11 Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.11.0 * Devolutions Server 2025.3.16.0 and earlier
CVE-2026-6706	Apr 28, 2026	Devolutions Server <2026.1.14: Improper ACL in Vault Docs API Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.
CVE-2026-4989	Apr 01, 2026	Devolutions Server 2026.1.11 SSRF via Gateway Health Check API Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.
CVE-2026-5175	Apr 01, 2026	Devolutions Server MFA API Access Control Flaw 2026.1.6-2026.1.11 Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests.  This issue affects Server: from 2026.1.6 through 2026.1.11.
CVE-2026-4925	Apr 01, 2026	Devolutions Server 2026.1.6-2026.1.11 MFA Access Control Bypass Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request. This issue affects Server: from 2026.1.6 through 2026.1.11.
CVE-2026-4927	Apr 01, 2026	Devolutions Server 2026.1.6-11: MFA API discloses OTP keys to privileged users Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.
CVE-2026-4924	Apr 01, 2026	Improper 2FA Auth in Devolutions Server 2026.1.11 and Prior Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the victim account via reuse of a partially authenticated session token.