Devolutions
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Devolutions product.
RSS Feeds for Devolutions security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Devolutions products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Devolutions Sorted by Most Security Vulnerabilities since 2018
By the Year
In 2026 there have been 49 vulnerabilities in Devolutions with an average score of 6.0 out of ten. Last year, in 2025 Devolutions had 34 security vulnerabilities published. That is, 15 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 1.00
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 49 | 5.99 |
| 2025 | 34 | 6.99 |
| 2024 | 27 | 5.52 |
| 2023 | 29 | 6.66 |
| 2022 | 12 | 7.13 |
| 2021 | 10 | 6.78 |
It may take a day or so for new Devolutions vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Devolutions Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-10696 | Jun 17, 2026 |
UniGetUI <2026.2.0 Pinget Backend Name Resolution VulnerabilityUse of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update. |
|
| CVE-2026-12105 | Jun 16, 2026 |
Devolutions Server 2026.2.5 Improper Access: Auth Users Access ATTACH via DupImproper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions. |
Devolutions Server
|
| CVE-2026-12117 | Jun 16, 2026 |
Devolutions Server 2026.2.5 Improper Access Control via Social Login EndpointImproper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request. |
Devolutions Server
|
| CVE-2026-11890 | Jun 16, 2026 |
Devolutions Server <2026.2.5 Improper Access Control in PAM Account DiscoveryImproper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results. |
Devolutions Server
|
| CVE-2026-12162 | Jun 15, 2026 |
Devolutions RDM 2026.2.8 Improper Host Validation in Social Login AutofillImproper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain. |
Remote Desktop Manager
|
| CVE-2026-12161 | Jun 15, 2026 |
RDM 2026.2.7 SSH Elevate Shell Auth'd Cmd Exec via Input Validation FlawImproper input validation in the SSH Elevate Shell feature in Devolutions Remote Desktop Manager 2026.2.7 allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action. |
Remote Desktop Manager
|
| CVE-2026-8694 | Jun 12, 2026 |
Devolutions PowerShell Universal 2026.1.7 Unauth Access OpenAPI LeakImproper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints. |
|
| CVE-2026-10544 | Jun 08, 2026 |
Devolutions Server <2026.2.4.0 PAM Provider Cmd Exec via Vault WriteImproper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier |
|
| CVE-2026-10787 | Jun 08, 2026 |
Devolutions Server 2026.2.4.0 API No Auth: Deleted Group Meta EnumMissing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier |
|
| CVE-2026-10786 | Jun 08, 2026 |
IA: Devolutions Server 2026.2.4.0 Ticketing Settings Credential LeakImproper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier |
|
| CVE-2026-9522 | Jun 02, 2026 |
Devolutions Server 2026.1.19 and earlier: Access Control Flaw in PAM DiscoveryImproper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations. |
|
| CVE-2026-9590 | Jun 02, 2026 |
Devolutions Server <2026.1.19 Improper Access Control in Permission ValidationImproper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission. |
|
| CVE-2026-7325 | May 22, 2026 |
Improper Auth. in Devolutions Server AD Browsing (v2026.1.616)Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with a stored PAM provider service account via authentication relay to an attacker-controlled server. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-9251 | May 22, 2026 |
Devolutions Server 2026 Auth Bypass via Entry Status ManagementMissing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-5171 | May 22, 2026 |
Devolutions Server 2026.1.16.0 Improper Access to Entry Activity Log via APIImproper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to retrieve that entry's activity logs via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-8477 | May 22, 2026 |
Devolutions Server 2026.1.6-2026.1.16: API sealed-entry bypass auditImproper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-9246 | May 22, 2026 |
Devolutions Server 2026 Improper Access in Entry Docs/APIImproper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-9224 | May 22, 2026 |
Devolutions Server 2026.1.616.0 Missing Authorization in User Profile Update APIMissing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-9249 | May 22, 2026 |
Devolutions Server 2026.1.6-2026.1.16 Unverified Password Change (CVE-2026-9249)Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-9245 | May 22, 2026 |
Devolutions Server 2026.1.6-16 Unauthenticated Redirect via External AuthImproper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-9247 | May 22, 2026 |
Devolutions Server: insufficient logging in export unseal bypassInsufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-9248 | May 22, 2026 |
Auth bypass in entry duplication (2026.1.6 - 2026.1.16) Devolutions ServerAuthorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier |
|
| CVE-2026-9223 | May 22, 2026 |
Missing Auth in Devolutions Server Vault Import (<2026.1.16.0) (CVE-2026-9223)Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request. |
|
| CVE-2026-9047 | May 22, 2026 |
Devolutions Server 2026.1.6-16.0 MFA Bypass via Factor Key MisstateImproper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 |
|
| CVE-2026-5146 | May 12, 2026 |
Devolutions Server 2025-2026 Improper Access Control in Notification EndpointsImproper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.15.0 * Devolutions Server 2025.3.19.0 and earlier |
|
| CVE-2026-8407 | May 12, 2026 |
Devolutions Server PAM Auth Leak: OTP Secrets Exposed 2025.3.16-2026.1.11Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.11.0 * Devolutions Server 2025.3.16.0 and earlier |
|
| CVE-2026-6706 | Apr 28, 2026 |
Devolutions Server <2026.1.14: Improper ACL in Vault Docs APIImproper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0. |
|
| CVE-2026-4989 | Apr 01, 2026 |
Devolutions Server 2026.1.11 SSRF via Gateway Health Check APIImproper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17. |
|
| CVE-2026-5175 | Apr 01, 2026 |
Devolutions Server MFA API Access Control Flaw 2026.1.6-2026.1.11Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests. This issue affects Server: from 2026.1.6 through 2026.1.11. |
|
| CVE-2026-4925 | Apr 01, 2026 |
Devolutions Server 2026.1.6-2026.1.11 MFA Access Control BypassImproper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request. This issue affects Server: from 2026.1.6 through 2026.1.11. |
|
| CVE-2026-4927 | Apr 01, 2026 |
Devolutions Server 2026.1.6-11: MFA API discloses OTP keys to privileged usersExposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11. |
|
| CVE-2026-4924 | Apr 01, 2026 |
Improper 2FA Auth in Devolutions Server 2026.1.11 and PriorImproper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the victim account via reuse of a partially authenticated session token. |
|
| CVE-2026-4828 | Apr 01, 2026 |
Devolutions Server <2026.1.11 MFA Bypass via OAuth AuthImproper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentication via a crafted login request. |
|
| CVE-2026-4829 | Apr 01, 2026 |
Devolutions Server 2026.1.11 Improper Auth in OAuth Flow (Session Code Reuse)Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow. |
|
| CVE-2026-4434 | Mar 20, 2026 |
pam-winrm Improper Cert Validation Allows MITM via WinRMImproper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification. |
|
| CVE-2026-4396 | Mar 18, 2026 |
Devolutions Hub Reporting Service 2025.3.1.1 MITM via TLS cert bypassImproper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification. |
|
| CVE-2026-3563 | Mar 17, 2026 |
PowerShell Universal <2026.1.4: Improper Input Validation Routing DoSImproper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path. |
|
| CVE-2026-4064 | Mar 17, 2026 |
PowerShell Universal <2026.1.4 gRPC Auth Bypass CVE-2026-4064Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations including reading sensitive data, creating or deleting resources, and disrupting service operations via crafted gRPC requests. |
|
| CVE-2026-3638 | Mar 09, 2026 |
Low-Priv Auth Restores Users/roles via API on Devolutions Server 2025.3.11.0Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests. |
|
| CVE-2026-3130 | Mar 03, 2026 |
Devolutions Server 2025.3.15: Auth Bulk Delete Triggers CheckedOut PAM RemovalImproper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion. |
|
| CVE-2026-3204 | Mar 03, 2026 |
Devolutions Server 2025.3.15 Improper Validation Spoofing (Err Msg Page)Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL. |
|
| CVE-2026-2590 | Mar 03, 2026 |
Disable-Password-Saving not enforced in Devolutions RDM 2025.3.30 (Connection Entry)Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled. |
Remote Desktop Manager
|
| CVE-2026-3224 | Mar 03, 2026 |
Devolutions Server 2025.3.15.0: Auth bypass via forged JWT (Entra ID)Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT). |
|
| CVE-2026-3277 | Feb 27, 2026 |
Cleartext OIDC Client Secret in PowerShell Universal < 2026.1.3The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials |
|
| CVE-2026-3221 | Feb 25, 2026 |
Devolutions Server 2025.3.14: Unencrypted user data in DB (CVE-2026-3221)Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access. |
|
| CVE-2026-1007 | Jan 19, 2026 |
Devolutions Server 2025.3.1-12 VG Auth BypassIncorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12. |
|
| CVE-2026-0610 | Jan 19, 2026 |
SQL Injection in Devolutions Server 2025.3.1-2025.3.12 remote-sessionsSQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 |
|
| CVE-2026-0747 | Jan 08, 2026 |
Devolutions RD Manager <2025.3.29: Pwd leak via TeamViewer entry mask on WinExposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing. |
Remote Desktop Manager
|
| CVE-2026-0618 | Jan 07, 2026 |
XSS in Devolutions PowerShell Universal <5.6.13 / <4.5.6Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13. |
|
| CVE-2025-13683 | Nov 28, 2025 |
Devolutions Server/Remote Desktop Manager Credential Leak 2025.3.8/2025.3.23Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0. |
Remote Desktop Manager
|