SE
Product
Server
63
CVEs
0
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 3High 12Medium 37Low 8
Watch
Add Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8407 | 4.3 | May 12 | Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys and recovery… Affected: 2026.1.6.0 through 2026.1.11.0; through 2025.3.16.0 |
| CVE-2026-4989 | 4.3 | Apr 1 | Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF),… Affected: 2026.1.1 through 2026.1.11; 2025.3.1 through 2025.3.17 |
| CVE-2026-15642 | 3.3 | Jul 14 | Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access… Affected: before 2026.1.23; before 2026.2.12 |
| CVE-2026-15058 | 3.1 | Jul 14 | Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a… Affected: before 2026.1.23; before 2026.2.12 |
| CVE-2026-9249 | 3.1 | May 22 | Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-12755 | 2.7 | Jun 25 | Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission… Affected: 2026.2.4.0 before 2026.2.7.0 |
| CVE-2026-8477 | 2.7 | May 22 | Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-110805 | 2.6 | Oct 16 | Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne… Affected: before 2026.3.10 |
| CVE-2026-9248 | 2.6 | May 22 | Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attachments from… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-9247 | 2.4 | May 22 | Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering the unseal… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
| CVE-2026-114487 New | – | Oct 22 | Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows an authenticated… Affected: 2026.3.5.0 before 2026.3.11; before 2026.2.21 |
| CVE-2026-114486 New | – | Oct 22 | Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated non-administrative attacker to bypass… Affected: before 2026.3.11 |
| CVE-2026-114485 New | – | Oct 22 | Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view… Affected: before 2026.3.11 |