What is CVE-2026-3221?

CVE-2026-3221 is a medium-severity vulnerability in Devolutions Server, classified under Cleartext Storage of Sensitive Information. CVSS score: 4.9/10. Published 2026-02-25.

How severe is CVE-2026-3221?

Medium severity. CVSS v3 base score is 4.9 out of 10.

Vulnerability in Devolutions Server

CVE-2026-3221

Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.

EPSS: 0.002 (5.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N.

Affected products

Devolutions Devolutions_server
Devolutions Server — versions 0

Weakness classification (CWE)

CWE-312 — Cleartext Storage of Sensitive Information

References

security@devolutions.net (Vendor Advisory)

Frequently asked questions

What is CVE-2026-3221?: CVE-2026-3221 is a medium-severity vulnerability in Devolutions Server, classified under Cleartext Storage of Sensitive Information. CVSS score: 4.9/10. Published 2026-02-25.
How severe is CVE-2026-3221?: Medium severity. CVSS v3 base score is 4.9 out of 10.