Devolutions vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Devolutions products: 81 record(s), with severity, exploitation and fixes.

Devolutions Server 61 Powershell Universal 11 Remote Desktop Manager 7 Hub Reporting Service 1 Unigetui 1 Password Manager 1

Exploited only (KEV) →

CVE-2025-13757 High · 8.8 CWE-89 Nov 27, 2025

SQL Injection in Devolutions Devolutions Server

SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.

CVE-2025-12808 Medium · 6.5 CWE-284 Nov 6, 2025

Improper Access Control in Devolutions Devolutions Server

Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosure. This issue affects the following versions : * Devolutions Server 2025.3.2.0 through 2025.3.5.0 * Devolutions Server 2025.2.15.0 and earlier

CVE-2025-12485 High · 8.8 CWE-269 Nov 6, 2025

Improper Privilege Management in Devolutions Devolutions Server

Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA verification step. This issue affects the following versions : * Devolutions Server 2025.3.2.0 through 2025.3.5.0 * Devolutions Server 2025.2.15.0 and earlier

CVE-2025-11958 Medium · 4.1 CWE-20 Oct 22, 2025

Improper Input Validation in Devolutions Devolutions Server

An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request.

CVE-2025-11957 High · 8.4 CWE-639 Oct 22, 2025

Authorization Bypass Through User-Controlled Key (IDOR) in Devolutions Devolutions Server

Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access to vaults and entries via crafted API requests.

CVE-2025-11619 High · 8.8 CWE-295 Oct 15, 2025

Improper Certificate Validation in Devolutions Devolutions Server

Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.