Devolutions
151 CVEs across 21 Devolutions products. Browse Devolutions vulnerabilities, severities, and proof-of-concept exploits.
Devolutions products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-19768 | High | 8.1 | 2026-08-14 | Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authentica… |
CVE-2026-8497 | High | 7.4 | 2026-07-29 | Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS… |
CVE-2026-17570 | Medium | 4.3 | 2026-07-27 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credentia… |
CVE-2026-17569 | Medium | 4.3 | 2026-07-27 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored… |
CVE-2026-17568 | High | 8.8 | 2026-07-27 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group… |
CVE-2026-16802 | Medium | 6.5 | 2026-07-24 | Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file sys… |
CVE-2026-16801 | High | 8.8 | 2026-07-24 | Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authentic… |
CVE-2026-16800 | High | 8.8 | 2026-07-24 | Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authentica… |
CVE-2026-16799 | Medium | 5.0 | 2026-07-24 | Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user wi… |
CVE-2026-16798 | Medium | 6.5 | 2026-07-24 | Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated u… |
CVE-2026-15642 | Low | 3.3 | 2026-07-14 | Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an at… |
CVE-2026-15641 | High | 7.1 | 2026-07-14 | Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve… |
CVE-2026-15637 | High | 7.5 | 2026-07-14 | Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileg… |
CVE-2026-15058 | Low | 3.1 | 2026-07-14 | Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user'… |
CVE-2026-14536 | High | 8.8 | 2026-07-06 | Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypas… |
CVE-2026-13437 | Medium | 6.5 | 2026-06-29 | Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Age… |
CVE-2026-13372 | High | 7.2 | 2026-06-26 | Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authen… |
CVE-2026-12755 | Low | 2.7 | 2026-06-25 | Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGro… |
CVE-2026-10696 | High | 7.5 | 2026-06-17 | Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contrib… |
CVE-2026-12117 | Medium | 4.3 | 2026-06-16 | Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login… |
CVE-2026-12105 | Medium | 6.5 | 2026-06-16 | Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited pe… |
CVE-2026-11890 | Medium | 4.3 | 2026-06-16 | Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery… |
CVE-2026-12162 | Medium | 5.5 | 2026-06-16 | Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social log… |
CVE-2026-12161 | High | 8.8 | 2026-06-16 | Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arb… |
CVE-2026-8694 | Medium | 5.3 | 2026-06-12 | Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification… |
CVE-2026-10787 | Medium | 4.3 | 2026-06-08 | Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user gr… |
CVE-2026-10786 | Medium | 6.5 | 2026-06-08 | Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials… |
CVE-2026-10544 | Medium | 6.5 | 2026-06-08 | Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with wr… |
CVE-2026-9590 | Medium | 5.3 | 2026-06-02 | Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privile… |
CVE-2026-9522 | Medium | 5.4 | 2026-06-02 | Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative pr… |
CVE-2026-9251 | Medium | 5.4 | 2026-05-22 | Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-en… |
CVE-2026-9249 | Low | 3.1 | 2026-05-22 | Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password chang… |
CVE-2026-9248 | Low | 2.6 | 2026-05-22 | Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation a… |
CVE-2026-9247 | Low | 2.4 | 2026-05-22 | Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without tr… |
CVE-2026-9246 | Medium | 4.3 | 2026-05-22 | Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retriev… |
CVE-2026-9245 | Medium | 5.0 | 2026-05-22 | Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to a… |
CVE-2026-9224 | Medium | 4.3 | 2026-05-22 | Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attrib… |
CVE-2026-9223 | Medium | 4.3 | 2026-05-22 | Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vault… |
CVE-2026-9047 | High | 7.6 | 2026-05-22 | Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's… |
CVE-2026-8477 | Low | 2.7 | 2026-05-22 | Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access… |
CVE-2026-7325 | High | 7.1 | 2026-05-22 | Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication mater… |
CVE-2026-5171 | Medium | 4.3 | 2026-05-22 | Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required p… |
CVE-2026-5146 | Medium | 4.3 | 2026-05-12 | Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user no… |
CVE-2026-8407 | Medium | 4.3 | 2026-05-12 | Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secre… |
CVE-2026-6706 | Medium | 6.5 | 2026-04-28 | Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unautho… |
CVE-2026-5175 | Medium | 5.0 | 2026-04-01 | Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own conf… |
CVE-2026-4989 | Medium | 4.3 | 2026-04-01 | Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request f… |
CVE-2026-4927 | Medium | 6.5 | 2026-04-01 | Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys vi… |
CVE-2026-4925 | Medium | 5.0 | 2026-04-01 | Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove th… |
CVE-2026-4924 | High | 8.2 | 2026-04-01 | Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid crede… |
CVE-2026-4829 | Medium | 5.4 | 2026-04-01 | Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as o… |
CVE-2026-4828 | High | 8.2 | 2026-04-01 | Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass… |
CVE-2026-4434 | High | 8.1 | 2026-03-20 | Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS cer… |
CVE-2026-4396 | High | 8.1 | 2026-03-18 | Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack v… |
CVE-2026-4064 | High | 8.3 | 2026-03-17 | Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to by… |
CVE-2026-3563 | Medium | 5.5 | 2026-03-17 | Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to crea… |
CVE-2026-3638 | Medium | 5.9 | 2026-03-09 | Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to rest… |
CVE-2026-3224 | Critical | 9.8 | 2026-03-03 | Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to… |
CVE-2026-3204 | Critical | 9.8 | 2026-03-03 | Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message v… |
CVE-2026-3130 | Critical | 9.8 | 2026-03-03 | Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a… |
CVE-2026-2590 | Critical | 9.8 | 2026-03-03 | Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and e… |
CVE-2026-3277 | Medium | 6.5 | 2026-02-27 | The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/a… |
CVE-2026-3221 | Medium | 4.9 | 2026-02-25 | Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the… |
CVE-2026-3131 | Medium | 6.5 | 2026-02-24 | Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permiss… |
CVE-2026-1768 | Medium | 4.3 | 2026-02-24 | A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devoluti… |
CVE-2026-1007 | High | 7.6 | 2026-01-19 | Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: fr… |
CVE-2026-0610 | Critical | 9.8 | 2026-01-19 | SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 |
CVE-2026-0747 | Low | 3.3 | 2026-01-08 | Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows… |
CVE-2026-0618 | Medium | 6.1 | 2026-01-07 | Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13. |
CVE-2025-13683 | Medium | 6.5 | 2025-11-28 | Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8… |
CVE-2025-13765 | Medium | 4.3 | 2025-11-27 | Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, bef… |
CVE-2025-13758 | Low | 3.5 | 2025-11-27 | Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-13757 | High | 8.8 | 2025-11-27 | SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-12808 | Medium | 6.5 | 2025-11-06 | Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting… |
CVE-2025-12485 | High | 8.8 | 2025-11-06 | Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by… |
CVE-2025-11958 | Medium | 4.1 | 2025-10-22 | An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a… |
CVE-2025-11957 | High | 8.4 | 2025-10-22 | Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or app… |
CVE-2025-11619 | High | 8.8 | 2025-10-15 | Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic. |
CVE-2025-8353 | Medium | 5.9 | 2025-07-30 | UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated… |
CVE-2025-8312 | High | 7.1 | 2025-07-30 | Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a dea… |
CVE-2025-6741 | High | 7.7 | 2025-07-22 | Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message ent… |
CVE-2025-6523 | High | 7.7 | 2025-07-22 | Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forci… |
CVE-2025-5382 | Medium | 6.8 | 2025-06-05 | Improper access control in users MFA feature in Devolutions Server 2025.1.7.0 and earlier allows a user with user management permission to remove or change adm… |
CVE-2025-3768 | Medium | 5.0 | 2025-06-05 | Improper access control in Tor network blocking feature in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the tor blocking f… |
CVE-2025-0691 | Medium | 5.0 | 2025-06-05 | Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "Edit permission" per… |
CVE-2025-4433 | High | 8.8 | 2025-05-30 | Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and… |
CVE-2025-5334 | High | 7.5 | 2025-05-29 | Exposure of private personal information to an unauthorized actor in the user vaults component of Devolutions Remote Desktop Manager allows an authenticated us… |
CVE-2025-4493 | Medium | 6.5 | 2025-05-28 | Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a PAM user to perform PAM JIT requests on unauthorized groups by exploit… |
CVE-2025-4316 | Medium | 4.3 | 2025-05-05 | Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy v… |
CVE-2025-3517 | Medium | 6.3 | 2025-05-01 | Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured u… |
CVE-2025-2600 | Medium | 6.8 | 2025-03-26 | Improper authorization in the variable component in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use the ELEVATED_PASSWORD var… |
CVE-2025-2562 | Medium | 5.4 | 2025-03-26 | Insufficient logging in the autotyping feature in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a stored password without g… |
CVE-2025-2528 | Low | 3.6 | 2025-03-26 | Improper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use a configuration dif… |
CVE-2025-2499 | Medium | 5.4 | 2025-03-26 | Client side access control bypass in the permission component in Devolutions Remote Desktop Manager on Windows. An authenticated user can exploit this flaw to… |
CVE-2025-2280 | High | 8.1 | 2025-03-13 | Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser… |
CVE-2025-2278 | Medium | 6.5 | 2025-03-13 | Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user t… |
CVE-2025-2277 | High | 7.5 | 2025-03-13 | Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password… |
CVE-2025-1636 | Medium | 6.5 | 2025-03-13 | Exposure of sensitive information in My Personal Credentials password history component in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows… |
CVE-2025-1635 | Medium | 6.5 | 2025-03-13 | Exposure of sensitive information in hub data source export feature in Devolutions Remote Desktop Manager 2024.3.29 and earlier on Windows allows a user export… |
CVE-2025-2003 | High | 7.1 | 2025-03-05 | Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission. |