Vulnerabilidades em Devolutions
199 resultadosAnálise Vexday
Com 153 CVEs catalogadas e 35 surgidas nos últimos 90 dias, o portfólio de vulnerabilidades da Devolutions apresenta atividade recente relevante que merece acompanhamento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, e nenhuma PoC pública foi identificada, o que reduz o risco imediato de exploração em massa. No entanto, a presença de 10 falhas críticas e o predomínio de CWE-284 (controle de acesso inadequado) indicam uma superfície de ataque estruturalmente sensível, especialmente em ambientes com gestão privilegiada de acessos remotos. A CVE mais perigosa atualmente rastreada, CVE-2021-42098, registra EPSS de 0,016, sugerindo probabilidade de exploração ainda baixa, mas equipes de segurança devem monitorar esse indicador dado o volume de novas entradas recentes.
CVE-2026-9247LOWInsufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealEPSS 0.2%CVE-2026-100286MEDIUMMissing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrativEPSS 0.2%CVE-2026-9224MEDIUMMissing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify theirEPSS 0.2%CVE-2026-9223MEDIUMMissing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user EPSS 0.2%CVE-2026-9246MEDIUMImproper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault reaEPSS 0.2%CVE-2026-9226MEDIUMAuthentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earlier allows a remote attacker to take overEPSS 0.2%CVE-2026-15058LOWImproper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to dEPSS 0.2%CVE-2024-1898LOWImproper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notEPSS 0.2%CVE-2026-3638MEDIUMImproper access control in user and role restore API endpoints in Devolutions Server 2025.3.11.0 and earlier allows a low-privileged authentEPSS 0.2%CVE-2026-6706MEDIUMImproper
access control in the vault documentation feature in Devolutions
Server allows an authenticated attacker to read documentation coEPSS 0.2%CVE-2026-4925MEDIUMImproper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restricEPSS 0.2%CVE-2026-110806MEDIUMIncorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permisEPSS 0.2%CVE-2026-116627HIGHImproper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell EPSS 0.2%CVE-2026-0747LOWExposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025EPSS 0.2%CVE-2026-114487MEDIUMMissing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and 2026.2.20.0 and earlieEPSS 0.2%CVE-2026-8407MEDIUMMissing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions EPSS 0.2%CVE-2026-10544MEDIUMImproper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authentEPSS 0.2%CVE-2026-9251MEDIUMMissing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass tEPSS 0.2%CVE-2026-93330MEDIUMImproper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypEPSS 0.2%CVE-2026-9249LOWUnverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a craEPSS 0.2%