Devolutions vulnerabilities
199 CVEs and advisories name Devolutions as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-9251Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass t
- CVE-2026-5171Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but wit
- CVE-2026-8477Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticate
- CVE-2026-9246Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault rea
- CVE-2026-9224Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their
- CVE-2026-9249Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a cra
- CVE-2026-9245Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to re
- CVE-2026-9247Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a seal
- CVE-2026-9248Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to c
- CVE-2026-9223Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user
- CVE-2026-9047Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with kn
- CVE-2026-5146Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delet
- CVE-2026-8407Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions
- CVE-2026-6706Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation co
- CVE-2026-4989Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform se
- CVE-2026-5175Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to de
- CVE-2026-4925Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restric
- CVE-2026-4927Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain othe
- CVE-2026-4924Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacke
- CVE-2026-4828Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid cre
- CVE-2026-4829Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user t
- CVE-2026-4434Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack vi
- CVE-2026-4396Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-
- CVE-2026-3563Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with
- CVE-2026-4064Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with an
- CVE-2026-3638Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authent
- CVE-2026-3130Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete per
- CVE-2026-3204Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displa
- CVE-2026-2590Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Mana
- CVE-2026-3224Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unaut