Vulnerabilidades en Devolutions
199 resultadosCVE-2026-105488HIGHMissing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vauEPSS 0.3%CVE-2026-1768MEDIUMA permission cache poisoning vulnerability in Devolutions Server allows authenticated users to bypass permissions to access entries.This issEPSS 0.3%CVE-2026-17570MEDIUMImproper access control in the PAM password history endpoints in Devolutions Server allows an authenticated low-privileged user to disclose EPSS 0.3%CVE-2026-16799MEDIUMImproper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an auEPSS 0.3%CVE-2026-15637HIGHImproper authorization in the PAM SSH key and certificate retrieval
endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an
authentEPSS 0.3%CVE-2026-8477LOWImproper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticateEPSS 0.2%CVE-2026-7325HIGHImproper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain aEPSS 0.2%CVE-2024-2918LOWImproper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM EPSS 0.2%CVE-2025-11619HIGHImproper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to EPSS 0.2%CVE-2026-114485MEDIUMInsufficient protection of sensitive information in the user list endpoint in Devolutions Server
2026.3.10.0 and earlier allows an authentiEPSS 0.2%CVE-2023-0463HIGHThe force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022EPSS 0.2%CVE-2026-5171MEDIUMImproper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but witEPSS 0.2%CVE-2026-11890MEDIUMImproper access control in PAM account discovery results in Devolutions
Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieveEPSS 0.2%CVE-2024-11621HIGHMissing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to intercept and modifEPSS 0.2%CVE-2026-4927MEDIUMExposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain otheEPSS 0.2%CVE-2026-9245MEDIUMImproper input validation in the external authentication provider flow in Devolutions Server allows an unauthenticated remote attacker to reEPSS 0.2%CVE-2024-1900MEDIUMImproper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticatEPSS 0.2%CVE-2026-8694MEDIUMImproper access control on the API documentation endpoint in PowerShell UniversalEPSS 0.2%CVE-2026-114486MEDIUMIncorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier allows an authenticated nEPSS 0.2%CVE-2026-1007HIGHIncorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issueEPSS 0.2%