Devolutions
Vulnerability activity for Devolutions: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 8
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- –UnscoredOct 27, 2026Devolutions PowerShell Universal XSSCVE-2026-116627Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.
- 6.5MediumOct 16, 2026devolutions server Auth bypass / access controlCVE-2026-110806Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the unredacted add-on properties returned in connection data.
- 2.6LowOct 16, 2026devolutions server SSRFCVE-2026-110805Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
- 4.3MediumOct 16, 2026devolutions serverCVE-2026-110804Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request.
- 4.3MediumOct 16, 2026devolutions server Auth bypass / access controlCVE-2026-110287Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general Edit but without Edit asset permission to modify the asset contact password via a crafted direct request to the partial-save endpoint.
- 8.8HighJul 6, 2026devolutions server Auth bypass / access controlCVE-2026-14536Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required policy and authenticate without completing multi-factor authentication. The problem occurs when DVLS encounters an invalid default MFA value.
- 8.2HighApr 1, 2026devolutions server Auth bypass / access controlCVE-2026-4924Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifactor authentication and gain unauthorized access to the victim account via reuse of a partially authenticated session token.
- 3.3LowJan 8, 2026Devolutions remote desktop manager Information disclosureCVE-2026-0747Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing.
Top products
- devolutions server6 CVEs in the last year
- remote desktop manager1 CVE in the last year
- PowerShell Universal1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.