Description
Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Devolutions | Server | < 2025.3.16 | 2025.3.16 |
Advisories 1
- WID-SEC-2026-0588 Devolutions Server und Remote Desktop Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 3, 2026