SE
Product
Server
63
CVEs
0
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 3High 12Medium 37Low 8
Watch
Add Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-3130 | 9.8 | Mar 3 | Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is… Affected: before 2025.3.16 |
| CVE-2026-3204 | 9.8 | Mar 3 | Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially… Affected: through 2025.3.16 |
| CVE-2026-3224 | 9.8 | Mar 3 | Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an… Affected: through 2025.3.15.0 |
| CVE-2026-17568 | 8.8 | Jul 27 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership… Affected: before 2026.1.24; 2026.2.4.0 before 2026.2.14 |
| CVE-2026-14536 | 8.8 | Jul 6 | Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required… Affected: 2026.2.4 before 2026.2.9 |
| CVE-2026-13327 | 8.3 | Sep 15 | Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged… Affected: through 2026.2.16 |
| CVE-2026-4924 | 8.2 | Apr 1 | Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass… Affected: through 2026.1.11 |
| CVE-2026-4828 | 8.2 | Apr 1 | Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor… Affected: through 2026.1.11 |
| CVE-2026-4434 | 8.1 | Mar 20 | Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate… Affected: before 2026.1 |
| CVE-2026-9047 | 7.6 | May 22 | Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass… Affected: 2026.1.6.0 through 2026.1.16.0 |
| CVE-2026-15637 | 7.5 | Jul 14 | Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose… Affected: before 2026.1.23; before 2026.2.12 |
| CVE-2026-100288 | 7.2 | Sep 29 | Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external… Affected: before 2026.3.7.0 |
| CVE-2026-105488 | 7.1 | Oct 6 | Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete… Affected: before 2026.3.8 |
| CVE-2026-15641 | 7.1 | Jul 14 | Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending… Affected: before 2026.1.23; before 2026.2.12 |
| CVE-2026-7325 | 7.1 | May 22 | Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-105485 | 6.8 | Oct 6 | Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a captured… Affected: before 2026.3.8 |
| CVE-2026-9226 | 6.8 | Oct 6 | Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's account via replay of a… Affected: before 2026.3.8 |
| CVE-2026-110806 | 6.5 | Oct 16 | Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the… Affected: before 2026.3.10 |
| CVE-2026-100286 | 6.5 | Sep 29 | Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets… Affected: before 2026.3.7.0 |
| CVE-2026-90969 | 6.5 | Sep 15 | Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain… Affected: through 2026.2.16 |
| CVE-2026-90971 | 6.5 | Sep 15 | Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other… Affected: through 2026.2.16 |
| CVE-2026-10544 | 6.5 | Jun 8 | Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a… Affected: 2026.2.4.0; through 2026.1.20.0 |
| CVE-2026-10786 | 6.5 | Jun 8 | Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured… Affected: 2026.2.4.0; through 2026.1.20.0 |
| CVE-2026-6706 | 6.5 | Apr 28 | Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a… Affected: 2026.1.6.0 through 2026.1.14.0; through 2025.3.18.0 |
| CVE-2026-4927 | 6.5 | Apr 1 | Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated… Affected: 2026.1.6 through 2026.1.11 |
| CVE-2026-3131 | 6.5 | Feb 24 | Improper access control in multiple DVLS REST API endpoints in Devolutions Server 2025.3.14.0 and earlier allows an authenticated user with view-only permission to access… Affected: before 2025.3.15 |
| CVE-2026-3638 | 5.9 | Mar 9 | Improper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authenticated user to restore deleted users… Affected: through 2025.3.11.0 |
| CVE-2026-100287 | 5.4 | Sep 29 | Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault… Affected: before 2026.3.7.0 |
| CVE-2026-93332 | 5.4 | Sep 29 | Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete… Affected: before 2026.3.7.0 |
| CVE-2026-9522 | 5.4 | Jun 2 | Improper access control in the PAM account discovery feature in Devolutions Server 2026.1.19 and earlier allows an authenticated user without administrative privileges to delete… Affected: through 2026.1.19 |
| CVE-2026-9251 | 5.4 | May 22 | Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced Pending… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-4829 | 5.4 | Apr 1 | Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users,… Affected: through 2026.1.11 |
| CVE-2026-9590 | 5.3 | Jun 2 | Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset… Affected: through 2026.1.19 |
| CVE-2026-100289 | 5.0 | Sep 29 | Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan… Affected: before 2026.3.7.0 |
| CVE-2026-9245 | 5.0 | May 22 | Improper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to redirect victims to an… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-5175 | 5.0 | Apr 1 | Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured MFA factors… Affected: 2026.1.6 through 2026.1.11 |
| CVE-2026-4925 | 5.0 | Apr 1 | Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own multi-factor… Affected: 2026.1.6 through 2026.1.11 |
| CVE-2026-3221 | 4.9 | Feb 25 | Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain… Affected: before 2025.3.15 |
| CVE-2026-84850 | 4.8 | Sep 15 | Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned… Affected: through 2026.2.16 |
| CVE-2026-110804 | 4.3 | Oct 16 | Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to… Affected: before 2026.3.10 |
| CVE-2026-110287 | 4.3 | Oct 16 | Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to… Affected: before 2026.3.10 |
| CVE-2026-93330 | 4.3 | Sep 29 | Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host… Affected: before 2026.3.7.0 |
| CVE-2026-17570 | 4.3 | Jul 27 | Improper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose plaintext credential secrets via… Affected: before 2026.1.24; 2026.2.4.0 before 2026.2.14 |
| CVE-2026-17569 | 4.3 | Jul 27 | Improper access control in the NetBox synchronizer in Devolutions Server allows an authenticated user with view-only permission on an entry to obtain a stored API token via the… Affected: before 2026.1.24; 2026.2.4.0 before 2026.2.14 |
| CVE-2026-10787 | 4.3 | Jun 8 | Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted… Affected: 2026.2.4.0; through 2026.1.20.0 |
| CVE-2026-5171 | 4.3 | May 22 | Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permission to… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-9246 | 4.3 | May 22 | Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the documentation… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-9224 | 4.3 | May 22 | Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via a crafted… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-9223 | 4.3 | May 22 | Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a crafted… Affected: through 2026.1.16.0 |
| CVE-2026-5146 | 4.3 | May 12 | Improper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or delete arbitrary user notification records… Affected: 2026.1.6.0 through 2026.1.15.0; through 2025.3.19.0 |