Devolutions Devolutions_server
109 CVEs affecting Devolutions Devolutions_server. Latest disclosed: 2026-07-14. Critical: 6, High: 29.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-3224 | Critical | 9.8 | 2026-03-03 | Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to… |
CVE-2026-3204 | Critical | 9.8 | 2026-03-03 | Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message v… |
CVE-2026-3130 | Critical | 9.8 | 2026-03-03 | Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a… |
CVE-2026-0610 | Critical | 9.8 | 2026-01-19 | SQL Injection vulnerability in remote-sessions in Devolutions Server.This issue affects Devolutions Server 2025.3.1 through 2025.3.12 |
CVE-2024-2921 | Critical | 9.8 | 2024-03-26 | Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access un… |
CVE-2021-23921 | Critical | 9.1 | 2021-04-01 | An issue was discovered in Devolutions Server before 2020.3. There is broken access control on Password List entry elements. |
CVE-2026-14536 | High | 8.8 | 2026-07-06 | Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypas… |
CVE-2025-13757 | High | 8.8 | 2025-11-27 | SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-12485 | High | 8.8 | 2025-11-06 | Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by… |
CVE-2025-11619 | High | 8.8 | 2025-10-15 | Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic. |
CVE-2025-4433 | High | 8.8 | 2025-05-30 | Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and… |
CVE-2024-2915 | High | 8.8 | 2024-03-26 | Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elev… |
CVE-2023-0953 | High | 8.8 | 2023-03-01 | Insufficient input sanitization in the documentation feature of Devolutions Server 2022.3.12 and earlier allows an authenticated attacker to perform an SQL Inj… |
CVE-2023-0951 | High | 8.8 | 2023-03-01 | Improper access controls on some API endpoints in Devolutions Server 2022.3.12 and earlier could allow a standard privileged user to perform privileged actio… |
CVE-2022-33996 | High | 8.8 | 2022-07-07 | Incorrect permission management in Devolutions Server before 2022.2 allows a new user with a preexisting username to inherit the permissions of that previous u… |
CVE-2025-11957 | High | 8.4 | 2025-10-22 | Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or app… |
CVE-2026-4924 | High | 8.2 | 2026-04-01 | Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid crede… |
CVE-2026-4828 | High | 8.2 | 2026-04-01 | Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass… |
CVE-2026-4434 | High | 8.1 | 2026-03-20 | Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS cer… |
CVE-2025-2280 | High | 8.1 | 2025-03-13 | Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser… |