Skip to content
OpenAdvisories

Product · Devolutions

Server

112 known vulnerabilities.

Server at a glance

Last 12 months
75
Critical · all time
7
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 10 20 December 2025: 0 vulnerabilities Dec 2025 January 2026: 2 vulnerabilities, 1 critical February 2026: 2 vulnerabilities March 2026: 5 vulnerabilities, 3 critical Mar April 2026: 8 vulnerabilities May 2026: 14 vulnerabilities June 2026: 6 vulnerabilities Jun July 2026: 8 vulnerabilities August 2026: 0 vulnerabilities September 2026: 10 vulnerabilities Sep October 2026: 10 vulnerabilities November 2026: 6 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202660
Oct 2026100
Sep 2026100
Aug 202600
Jul 202680
Jun 202660
May 2026140
Apr 202680
Mar 202653
Feb 202620
Jan 202621
Dec 202500
Nov 202560
Oct 202521
Sep 202500
Aug 202500
Jul 202541
Jun 202530
May 202530
Apr 202500
Mar 202540
Feb 202510
Jan 202500
Dec 202430

Latest advisories

  • High max 8.8
    WID-SEC-2026-4306 6 CVEs

    Devolutions Server: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Devolutions Server ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.

    Devolutions Windows
  • Low max 4.3
    WID-SEC-2026-4128 3 CVEs

    Devolutions Server: Mehrere Schwachstellen

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Devolutions Server ausnutzen, um Informationen offenzulegen und Sicherheitsvorkehrungen zu umgehen.

    Devolutions Windows
  • Medium max 6.5
    WID-SEC-2026-3993 4 CVEs rev. 2

    Devolutions Server: Mehrere Schwachstellen

    Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Devolutions Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen und um seine Privilegien zu erhöhen.

    Devolutions Windows
    first Oct 15, 2026
  • Medium max 7.1
    WID-SEC-2026-3763 3 CVEs

    Devolutions Server: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Devolutions Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Daten zu manipulieren.

    Devolutions Windows
  • Medium max 7.2
    WID-SEC-2026-3635 6 CVEs

    Devolutions Server: Mehrere Schwachstellen

    Ein Angreifer kann mehrere Schwachstellen in Devolutions Server ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

    Devolutions Windows
All Critical High Medium Low Exploited only Public exploit

112 results · Feed

  • Medium 6.5
    CVE-2026-120716

    Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2…

    Devolutions Server
  • High 8.8
    CVE-2026-119636

    Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3…

    Devolutions Server
  • Medium 6.5
    CVE-2026-120734

    Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and e…

    Devolutions Server
  • High 8.1
    CVE-2026-120715

    Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier…

    Devolutions Server
  • High 7.5
    CVE-2026-120733

    Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allow…

    Devolutions Server
  • High 8.1
    CVE-2026-121580

    Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an…

    Devolutions Server
  • Medium 4.3
    CVE-2026-114487

    Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2…

    Devolutions Server
  • Medium 4.3
    CVE-2026-114486

    Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0  and earlier allo…

    Devolutions Server
  • Medium 4.3
    CVE-2026-114485

    Insufficient protection of sensitive information in the user list endpoint in Devolutions Server  2026.3.10.0 and earli…

    Devolutions Server
  • Low 2.6
    CVE-2026-110805

    Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authentic…

    Devolutions Server
  • Medium 4.3
    CVE-2026-110804

    Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earli…

    Devolutions Server
  • Medium 6.5
    CVE-2026-110806

    Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user …

    Devolutions Server
  • Medium 4.3
    CVE-2026-110287

    Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated …

    Devolutions Server
  • High 7.1
    CVE-2026-105488

    Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user wit…

    Devolutions Server
  • Medium 6.8
    CVE-2026-105485

    Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote atta…

    Devolutions Server
  • Medium 6.8
    CVE-2026-9226

    Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote …

    Devolutions Server
  • Medium 5.0
    CVE-2026-100289

    Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an auth…

    Devolutions Server
  • High 7.2
    CVE-2026-100288

    Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attac…

    Devolutions Server
  • Medium 5.4
    CVE-2026-100287

    Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticate…

    Devolutions Server
  • Medium 6.5
    CVE-2026-100286

    Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authentica…

    Devolutions Server
  • Medium 5.4
    CVE-2026-93332

    Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authentica…

    Devolutions Server
  • Medium 4.3
    CVE-2026-93330

    Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM ed…

    Devolutions Server
  • High 8.3
    CVE-2026-13327

    Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier al…

    Devolutions Server
  • Medium 4.8
    CVE-2026-84850

    Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutio…

    Devolutions Server
  • Medium 6.5
    CVE-2026-90969

    Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authen…

    Devolutions Server
  • Medium 6.5
    CVE-2026-90971

    Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier al…

    Devolutions Server
  • Medium 4.3
    CVE-2026-17570

    Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privile…

    Devolutions Server
  • Medium 4.3
    CVE-2026-17569

    Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only pe…

    Devolutions Server
  • High 8.8
    CVE-2026-17568

    Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-ad…

    Devolutions Server
  • Low 3.1
    CVE-2026-15058

    Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an au…

    Devolutions Server
  • Low 3.3
    CVE-2026-15642

    Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Serv…

    Devolutions Server
  • High 7.1
    CVE-2026-15641

    Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authe…

    Devolutions Server
  • High 7.5
    CVE-2026-15637

    Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.2…

    Devolutions Server
  • High 7.3
    CVE-2026-14536

    Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attac…

    Devolutions Server
  • Low 2.7
    CVE-2026-12755

    Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows …

    Devolutions Server
  • Medium 6.5
    CVE-2026-10544

    Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Ser…

    Devolutions Server
  • Medium 4.3
    CVE-2026-10787

    Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user …

    Devolutions Server
  • Medium 6.5
    CVE-2026-10786

    Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privile…

    Devolutions Server
  • Medium 5.4
    CVE-2026-9522

    Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an auth…

    Devolutions Server
  • Medium 5.3
    CVE-2026-9590

    Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an au…

    Devolutions Server