[ Vendor · 16 CVEs ]
Devolutions
CVEs affecting Devolutions published in the last 30 days, plus any Devolutions CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114485 | 22 Oct 2026 | Not scored yet | Devolutions ServerInsufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and earlier allows an authenticated… | |
| CVE-2026-114486 | 22 Oct 2026 | Not scored yet | Devolutions ServerIncorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated… | |
| CVE-2026-114487 | 22 Oct 2026 | Not scored yet | Devolutions ServerMissing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlier allows… | |
| CVE-2026-110287 | 16 Oct 2026 | CVSS 4.3 | Devolutions ServerImproper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but… | |
| CVE-2026-110804 | 16 Oct 2026 | CVSS 4.3 | Devolutions ServerImproperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated… | |
| CVE-2026-110805 | 16 Oct 2026 | CVSS 2.6 | Devolutions ServerServer-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to… | |
| CVE-2026-110806 | 16 Oct 2026 | CVSS 6.5 | Devolutions ServerIncorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to… | |
| CVE-2026-9226 | 6 Oct 2026 | CVSS 6.8 | Devolutions ServerAuthentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's… | |
| CVE-2026-105488 | 6 Oct 2026 | CVSS 7.1 | Devolutions ServerMissing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view… | |
| CVE-2026-105485 | 6 Oct 2026 | CVSS 6.8 | Devolutions ServerAuthentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take over a user's… | |
| CVE-2026-93330 | 29 Sep 2026 | CVSS 4.3 | Devolutions ServerImproper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the… | |
| CVE-2026-93332 | 29 Sep 2026 | CVSS 5.4 | Devolutions ServerImproper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to… | |
| CVE-2026-100286 | 29 Sep 2026 | CVSS 6.5 | Devolutions ServerMissing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to… | |
| CVE-2026-100287 | 29 Sep 2026 | CVSS 5.4 | Devolutions ServerMissing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to… | |
| CVE-2026-100288 | 29 Sep 2026 | CVSS 7.2 | Devolutions ServerCleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the… | |
| CVE-2026-100289 | 29 Sep 2026 | CVSS 5.0 | Devolutions ServerMissing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user… |