DS
Product
Devolutions Server
116
CVEs
0
On KEV
9.8
Max CVSS
4
New 30D
Severity mix
Critical 6High 30Medium 68Low 12
Watch
Add Devolutions Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-11890 | 4.3 | Jun 16 | Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve account discovery scan results Affected: before 2026.2.5; before 2026.1.21 |
| CVE-2026-10787 | 4.3 | Jun 8 | Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted… Affected: before 2026.1.21.0; 2026.2.4.0 |
| CVE-2026-5171 | 4.3 | May 22 | Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to… Affected: before 2025.3.22.0; 2026.1.6.0 before 2026.1.19.0 |
| CVE-2026-9246 | 4.3 | May 22 | Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation… Affected: before 2025.3.22.0; 2026.1.6.0 before 2026.1.19.0 |
| CVE-2026-9224 | 4.3 | May 22 | Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted… Affected: before 2025.3.22.0; 2026.1.6.0 before 2026.1.19.0 |
| CVE-2026-9223 | 4.3 | May 22 | Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted… Affected: before 2026.1.19.0 |
| CVE-2026-5146 | 4.3 | May 12 | Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records… Affected: before 2025.3.20.0; 2026.1.6.0 before 2026.1.16.0 |
| CVE-2026-8407 | 4.3 | May 12 | Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery… Affected: before 2025.3.18.0; 2026.1.6.0 before 2026.1.12.0 |
| CVE-2026-4989 | 4.3 | Apr 1 | Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF),… Affected: 2025.3.1.0 before 2025.3.18.0; 2026.1.1.0 before 2026.1.12.0 |
| CVE-2026-1768 | 4.3 | Feb 24 | A permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issue affects Devolutions Server: before… Affected: before 2025.3.15 |
| CVE-2025-13765 | 4.3 | Nov 27 | Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, before 2025.3.9 Affected: before 2025.2.21.0; 2025.3.2.0 before 2025.3.10.0 |
| CVE-2025-4316 | 4.3 | May 5 | Improper access control in PAM feature in Devolutions Server allows a PAM user to self approve their PAM requests even if disallowed by the configured policy via specific user… Affected: before 2024.3.17.0; 2025.1.3.0 before 2025.1.7.0 |
| CVE-2024-12148 | 4.3 | Dec 4 | Incorrect authorization in permission validation component in Devolutions Server 2024.3.6.0 and earlier allows an authenticated user to access some reporting endpoints Affected: before 2024.3.7.0 |
| CVE-2024-10971 | 4.3 | Nov 12 | Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data via faulty… Affected: before 2024.3.7.0 |
| CVE-2024-3545 | 4.3 | Apr 9 | Improper permission handling in the vault offline cache feature in Devolutions Remote Desktop Manager 2024.1.20 and earlier on windows and Devolutions Server 2024.1.8 and earlier… Affected: before 2024.1.9.0 |
| CVE-2024-1901 | 4.3 | Mar 5 | Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with specific PAM permissions to make PAM… Affected: through 2023.3.16.0 |
| CVE-2024-1898 | 4.3 | Mar 5 | Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notifications settings configured by an… Affected: before 2024.1.0 |
| CVE-2025-11958 | 4.1 | Oct 22 | An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to… Affected: through 2025.2.15.0 |