Devolutions vulnerabilities
199 CVEs and advisories name Devolutions as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-3277The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext i
- CVE-2026-3221Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker w
- CVE-2026-3131Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user wit
- CVE-2026-1768A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This iss
- CVE-2026-1007Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue
- CVE-2026-0610SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12
- CVE-2026-0747Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025
- CVE-2026-0618Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.
- CVE-2025-13683Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Serve
- CVE-2025-13758Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8.
- CVE-2025-13757SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.
- CVE-2025-13765Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: be
- CVE-2025-12485Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate
- CVE-2025-12808Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custo
- CVE-2025-11957Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to
- CVE-2025-11958An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticat
- CVE-2025-11619Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to
- CVE-2025-8312Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out
- CVE-2025-8353UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a r
- CVE-2025-6741Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the
- CVE-2025-6523Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authenticat
- CVE-2025-0691Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "E
- CVE-2025-5382Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to r
- CVE-2025-3768Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass
- CVE-2025-4433Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "Us
- CVE-2025-5334Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows
- CVE-2025-4493Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorize
- CVE-2025-4316Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the
- CVE-2025-3517Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a prev
- CVE-2025-2600Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the EL