Devolutions

By the Year

In 2026 there have been 57 vulnerabilities in Devolutions with an average score of 5.9 out of ten. Last year, in 2025 Devolutions had 34 security vulnerabilities published. That is, 23 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 1.06

Recent Devolutions Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-15058	Jul 14, 2026	Devolutions Server 2026.2.11 Improper Auth: Delete Chat Messages Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier.
CVE-2026-15642	Jul 14, 2026	Sensitive Data Leak in Devolutions Server 2026.1.22 via Recovery Kit Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected.
CVE-2026-15641	Jul 14, 2026	Improper Auth: Devolutions Server 2026.2.11 request status endpoint Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review.
CVE-2026-15637	Jul 14, 2026	Devolutions Server 2026.2.11 & 2026.1.22: Improper Auth Reveals SSH Private Key Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier.
CVE-2026-14536	Jul 06, 2026	Devolutions Server 2026.2.9.0 MFA Policy Bypass vulnerability Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.
CVE-2026-13437	Jun 29, 2026	Devolutions PowerShell Universal 2026.2.0 AI Agent job API Sensitive Data Exposure Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.
CVE-2026-13372	Jun 26, 2026	Remote Desktop Manager 2026.2.52026.2.11 PS VPN Editor Link Collision RCE Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link.	Remote Desktop Manager
CVE-2026-12755	Jun 25, 2026	Devolutions Server 2026.2.47.0 Improper PAM AD discovery: NTLMv2 creds leakage Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.
CVE-2026-10696	Jun 17, 2026	UniGetUI <2026.2.0 Pinget Backend Name Resolution Vulnerability Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update.
CVE-2026-12105	Jun 16, 2026	Devolutions Server 2026.2.5 Improper Access: Auth Users Access ATTACH via Dup Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.	Devolutions Server
CVE-2026-12117	Jun 16, 2026	Devolutions Server 2026.2.5 Improper Access Control via Social Login Endpoint Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.	Devolutions Server
CVE-2026-11890	Jun 16, 2026	Devolutions Server <2026.2.5 Improper Access Control in PAM Account Discovery Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.	Devolutions Server
CVE-2026-12162	Jun 15, 2026	Devolutions RDM 2026.2.8 Improper Host Validation in Social Login Autofill Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.	Remote Desktop Manager
CVE-2026-12161	Jun 15, 2026	RDM 2026.2.7 SSH Elevate Shell Auth'd Cmd Exec via Input Validation Flaw Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action. This affects  :  - Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0 - Remote Desktop Manager 2026.1.23.0 and earlier	Remote Desktop Manager
CVE-2026-8694	Jun 12, 2026	Devolutions PowerShell Universal 2026.1.7 Unauth Access OpenAPI Leak Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.
CVE-2026-10544	Jun 08, 2026	Devolutions Server <2026.2.4.0 PAM Provider Cmd Exec via Vault Write Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
CVE-2026-10787	Jun 08, 2026	Devolutions Server 2026.2.4.0 API No Auth: Deleted Group Meta Enum Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
CVE-2026-10786	Jun 08, 2026	IA: Devolutions Server 2026.2.4.0 Ticketing Settings Credential Leak Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier
CVE-2026-9522	Jun 02, 2026	Devolutions Server 2026.1.19 and earlier: Access Control Flaw in PAM Discovery Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.
CVE-2026-9590	Jun 02, 2026	Devolutions Server <2026.1.19 Improper Access Control in Permission Validation Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission.
CVE-2026-7325	May 22, 2026	Improper Auth. in Devolutions Server AD Browsing (v2026.1.616) Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with a stored PAM provider service account via authentication relay to an attacker-controlled server. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9251	May 22, 2026	Devolutions Server 2026 Auth Bypass via Entry Status Management Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-5171	May 22, 2026	Devolutions Server 2026.1.16.0 Improper Access to Entry Activity Log via API Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to retrieve that entry's activity logs via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-8477	May 22, 2026	Devolutions Server 2026.1.6-2026.1.16: API sealed-entry bypass audit Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9246	May 22, 2026	Devolutions Server 2026 Improper Access in Entry Docs/API Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9224	May 22, 2026	Devolutions Server 2026.1.616.0 Missing Authorization in User Profile Update API Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9249	May 22, 2026	Devolutions Server 2026.1.6-2026.1.16 Unverified Password Change (CVE-2026-9249) Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9245	May 22, 2026	Devolutions Server 2026.1.6-16 Unauthenticated Redirect via External Auth Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9247	May 22, 2026	Devolutions Server: insufficient logging in export unseal bypass Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9248	May 22, 2026	Auth bypass in entry duplication (2026.1.6 - 2026.1.16) Devolutions Server Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier
CVE-2026-9223	May 22, 2026	Missing Auth in Devolutions Server Vault Import (<2026.1.16.0) (CVE-2026-9223) Missing authorization in the vault import feature in Devolutions Server  2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted import request.
CVE-2026-9047	May 22, 2026	Devolutions Server 2026.1.6-16.0 MFA Bypass via Factor Key Misstate Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0
CVE-2026-5146	May 12, 2026	Devolutions Server 2025-2026 Improper Access Control in Notification Endpoints Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records via missing session validation. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.15.0 * Devolutions Server 2025.3.19.0 and earlier
CVE-2026-8407	May 12, 2026	Devolutions Server PAM Auth Leak: OTP Secrets Exposed 2025.3.16-2026.1.11 Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery codes via crafted requests to PAM API endpoints. This issue affects the following versions : * Devolutions Server 2026.1.6.0 through 2026.1.11.0 * Devolutions Server 2025.3.16.0 and earlier
CVE-2026-6706	Apr 28, 2026	Devolutions Server <2026.1.14: Improper ACL in Vault Docs API Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.
CVE-2026-4989	Apr 01, 2026	Devolutions Server 2026.1.11 SSRF via Gateway Health Check API Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.
CVE-2026-5175	Apr 01, 2026	Devolutions Server MFA API Access Control Flaw 2026.1.6-2026.1.11 Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors and reduce account protection to password-only authentication via crafted HTTP requests.  This issue affects Server: from 2026.1.6 through 2026.1.11.
CVE-2026-4925	Apr 01, 2026	Devolutions Server 2026.1.6-2026.1.11 MFA Access Control Bypass Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor authentication (MFA) configuration via a crafted request. This issue affects Server: from 2026.1.6 through 2026.1.11.
CVE-2026-4927	Apr 01, 2026	Devolutions Server 2026.1.6-11: MFA API discloses OTP keys to privileged users Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated API request. This issue affects Server: from 2026.1.6 through 2026.1.11.
CVE-2026-4924	Apr 01, 2026	Improper 2FA Auth in Devolutions Server 2026.1.11 and Prior Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the victim account via reuse of a partially authenticated session token.
CVE-2026-4828	Apr 01, 2026	Devolutions Server <2026.1.11 MFA Bypass via OAuth Auth Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentication via a crafted login request.
CVE-2026-4829	Apr 01, 2026	Devolutions Server 2026.1.11 Improper Auth in OAuth Flow (Session Code Reuse) Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, including administrators, via reuse of a session code from an external authentication flow.
CVE-2026-4434	Mar 20, 2026	pam-winrm Improper Cert Validation Allows MITM via WinRM Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.
CVE-2026-4396	Mar 18, 2026	Devolutions Hub Reporting Service 2025.3.1.1 MITM via TLS cert bypass Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.
CVE-2026-3563	Mar 17, 2026	PowerShell Universal <2026.1.4: Improper Input Validation Routing DoS Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path.
CVE-2026-4064	Mar 17, 2026	PowerShell Universal <2026.1.4 gRPC Auth Bypass CVE-2026-4064 Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations including reading sensitive data, creating or deleting resources, and disrupting service operations via crafted gRPC requests.
CVE-2026-3638	Mar 09, 2026	Low-Priv Auth Restores Users/roles via API on Devolutions Server 2025.3.11.0 Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users and roles via crafted API requests.
CVE-2026-3130	Mar 03, 2026	Devolutions Server 2025.3.15: Auth Bulk Delete Triggers CheckedOut PAM Removal Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.
CVE-2026-3204	Mar 03, 2026	Devolutions Server 2025.3.15 Improper Validation Spoofing (Err Msg Page) Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.
CVE-2026-2590	Mar 03, 2026	Disable-Password-Saving not enforced in Devolutions RDM 2025.3.30 (Connection Entry) Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled.	Remote Desktop Manager