SE
Product
Server
63
CVEs
0
On KEV
9.8
Max CVSS
16
New 30D
Severity mix
Critical 3High 12Medium 37Low 8
Watch
Add Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-17568 | 8.8 | Jul 27 | Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership… Affected: before 2026.1.24; 2026.2.4.0 before 2026.2.14 |
| CVE-2026-14536 | 8.8 | Jul 6 | Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required… Affected: 2026.2.4 before 2026.2.9 |
| CVE-2026-13327 | 8.3 | Sep 15 | Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged… Affected: through 2026.2.16 |
| CVE-2026-4924 | 8.2 | Apr 1 | Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass… Affected: through 2026.1.11 |
| CVE-2026-4828 | 8.2 | Apr 1 | Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor… Affected: through 2026.1.11 |
| CVE-2026-4434 | 8.1 | Mar 20 | Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate… Affected: before 2026.1 |
| CVE-2026-9047 | 7.6 | May 22 | Improper handling of factor key state in the multi-factor authentication management feature in Devolutions Server allows an attacker with knowledge of a user's password to bypass… Affected: 2026.1.6.0 through 2026.1.16.0 |
| CVE-2026-15637 | 7.5 | Jul 14 | Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose… Affected: before 2026.1.23; before 2026.2.12 |
| CVE-2026-100288 | 7.2 | Sep 29 | Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external… Affected: before 2026.3.7.0 |
| CVE-2026-105488 | 7.1 | Oct 6 | Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete… Affected: before 2026.3.8 |
| CVE-2026-15641 | 7.1 | Jul 14 | Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending… Affected: before 2026.1.23; before 2026.2.12 |
| CVE-2026-7325 | 7.1 | May 22 | Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with… Affected: 2026.1.6.0 through 2026.1.16.0; through 2025.3.20.0 |
Showing 12