Devolutions vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-105488 Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission tHigh 7.1 · Oct 6, 2026
• CVE-2026-100288 Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to oHigh 7.2 · Sep 29, 2026
• CVE-2026-13327 Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intHigh 8.3 · Sep 15, 2026
• CVE-2026-19768 Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticatHigh 8.1 · Aug 14, 2026
• CVE-2026-8497 Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS High 7.4 · Jul 29, 2026
• CVE-2026-17568 Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group High 8.8 · Jul 27, 2026
• CVE-2026-16801 Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticaHigh 8.8 · Jul 24, 2026
• CVE-2026-16800 Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticatHigh 8.8 · Jul 24, 2026
• CVE-2026-15641 Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve tHigh 7.1 · Jul 14, 2026
• CVE-2026-15637 Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privilegeHigh 7.5 · Jul 14, 2026
• CVE-2026-14536 Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypassHigh 8.8 · Jul 6, 2026
• CVE-2026-13372 Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authentHigh 7.2 · Jun 26, 2026
• CVE-2026-10696 Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contribuHigh 7.5 · Jun 17, 2026
• CVE-2026-12161 Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbiHigh 8.8 · Jun 15, 2026
• CVE-2026-9047 Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's High 7.6 · May 22, 2026
• CVE-2026-7325 Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication materiHigh 7.1 · May 22, 2026
• CVE-2026-4924 Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credenHigh 8.2 · Apr 1, 2026
• CVE-2026-4828 Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass mHigh 8.2 · Apr 1, 2026
• CVE-2026-4434 Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certHigh 8.1 · Mar 20, 2026
• CVE-2026-4396 Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack viHigh 8.1 · Mar 18, 2026
• CVE-2026-4064 Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypHigh 8.3 · Mar 17, 2026
• CVE-2026-3224 Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to aCritical 9.8 · Mar 3, 2026
• CVE-2026-3204 Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message viCritical 9.8 · Mar 3, 2026
• CVE-2026-3130 Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a Critical 9.8 · Mar 3, 2026
• CVE-2026-2590 Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and eaCritical 9.8 · Mar 3, 2026