[ CVE-2026-100288 · Published 29 Sep 2026 ]

Vulnerability in Devolutions Server

CVSS 7.2 EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund29 Sep 2026WID-SEC-2026-3635

Devolutions Server: Multiple vulnerabilities Translated from German
CVE-2026-100288CVE-2026-93332CVE-2026-100286+3 more CVEs

[ References ]References

devolutions.net/security/advisories/DEVO-2026-0034

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Devolutions Server: Multiple vulnerabilities Translated from German

[ References ]References