Devolutions vulnerabilities

CVE-2026-9226 Medium · 6.8 CWE-294 Oct 6, 2026

Authentication Bypass by Capture-replay in Devolutions Devolutions Server

Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured login-session token exposed in a redirect URL.

CVE-2026-105488 High · 7.1 CWE-862 Oct 6, 2026

Missing Authorization in Devolutions Devolutions Server

Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.

CVE-2026-105485 Medium · 6.8 CWE-294 Oct 6, 2026

Authentication Bypass by Capture-replay in Devolutions Devolutions Server

Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured device verification link by an authenticated victim.

CVE-2026-78417 Medium · 4.3 CWE-345 Aug 24, 2026

Insufficient Verification of Data Authenticity in Devolutions Remote Desktop Manager

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.

CVE-2026-13437 Medium · 6.5 CWE-201 Jun 29, 2026

Insertion of Sensitive Information Into Sent Data in Devolutions Powershell Universal

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.

CVE-2026-13372 High · 7.2 CWE-706 Jun 26, 2026

Use of Incorrectly-Resolved Name or Reference in Devolutions Remote Desktop Manager

Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link.

CVE-2026-12755 Low · 2.7 CWE-1284 Jun 25, 2026

Improper input validation in the PAM AD discovery endpoints in Devolutions Server…

Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.

CVE-2026-10696 High · 7.5 CWE-706 Jun 17, 2026

Use of Incorrectly-Resolved Name or Reference in Devolutions Unigetui

Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update.

CVE-2026-12117 Medium · 4.3 CWE-200 Jun 16, 2026

Exposure of Sensitive Information in Devolutions Devolutions Server

Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enumerate social login entry metadata to which they are not authorized via a crafted API request.

CVE-2026-12105 Medium · 6.5 CWE-862 Jun 16, 2026

Missing Authorization in Devolutions Devolutions Server

Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.

CVE-2026-11890 Medium · 4.3 CWE-882 Jun 16, 2026

Improper access control in PAM account discovery results in Devolutions Server 2026.2.5…

Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results.

CVE-2026-12162 Medium · 5.5 CWE-297 Jun 15, 2026

Improper host validation in the social login autofill feature in Devolutions Remote…

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.

CVE-2026-12161 High · 8.8 CWE-78 Jun 15, 2026

OS Command Injection in Devolutions Remote Desktop Manager

Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action. This affects : - Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0 - Remote Desktop Manager 2026.1.23.0 and earlier

CVE-2026-8694 Medium · 5.3 CWE-306 Jun 12, 2026

Improper access control on the API documentation endpoint in PowerShell Universal

Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.

CVE-2026-10787 Medium · 4.3 CWE-862 Jun 8, 2026

Missing Authorization in Devolutions Devolutions Server

Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

CVE-2026-10786 Medium · 6.5 CWE-312 Jun 8, 2026

Cleartext Storage of Sensitive Information in Devolutions Devolutions Server

Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

CVE-2026-10544 Medium · 6.5 CWE-78 Jun 8, 2026

OS Command Injection in Devolutions Devolutions Server

Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider. This issue affects : * Devolutions Server 2026.2.4.0 * Devolutions Server 2026.1.20.0 and earlier

CVE-2026-9590 Medium · 5.3 CWE-284 Jun 2, 2026

Improper Access Control in Devolutions Devolutions Server

Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission.

CVE-2026-9522 Medium · 5.4 CWE-284 Jun 2, 2026

Improper Access Control in Devolutions Devolutions Server

Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete network discovery scan configurations.

CVE-2026-9251 Medium · 5.4 CWE-862 May 22, 2026

Missing Authorization in Devolutions Devolutions Server

Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending Approval flow and gain access to an entry's data via a crafted status change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier

CVE-2026-9249 Low · 3.1 CWE-620 May 22, 2026

Unverified password change in Devolutions Server allows an attacker to change a user's…

Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier

CVE-2026-9248 Low · 2.6 CWE-639 May 22, 2026

Authorization Bypass Through User-Controlled Key (IDOR) in Devolutions Devolutions Server

Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier

CVE-2026-9247 Low · 2.4 CWE-778 May 22, 2026

Insufficient logging in the entry export feature in Devolutions Server allows an…

Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier

CVE-2026-9246 Medium · 4.3 CWE-862 May 22, 2026

Missing Authorization in Devolutions Devolutions Server

Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation and attachments of sealed entries via a crafted API request. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier

CVE-2026-9245 Medium · 5.0 CWE-601 May 22, 2026

Open Redirect in Devolutions Devolutions Server

Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an attacker-controlled domain via a crafted login link. This issue affects : * Devolutions Server 2026.1.6.0 through 2026.1.16.0 * Devolutions Server 2025.3.20.0 and earlier