Vulnerabilidades em Devolutions

199 resultados
Análise Vexday

Com 153 CVEs catalogadas e 35 surgidas nos últimos 90 dias, o portfólio de vulnerabilidades da Devolutions apresenta atividade recente relevante que merece acompanhamento contínuo. A taxa de exploração ativa está abaixo da média geral do catálogo CISA KEV, e nenhuma PoC pública foi identificada, o que reduz o risco imediato de exploração em massa. No entanto, a presença de 10 falhas críticas e o predomínio de CWE-284 (controle de acesso inadequado) indicam uma superfície de ataque estruturalmente sensível, especialmente em ambientes com gestão privilegiada de acessos remotos. A CVE mais perigosa atualmente rastreada, CVE-2021-42098, registra EPSS de 0,016, sugerindo probabilidade de exploração ainda baixa, mas equipes de segurança devem monitorar esse indicador dado o volume de novas entradas recentes.

CVE-2026-9248LOWAuthorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to cEPSS 0.2%CVE-2026-3277MEDIUMThe OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext iEPSS 0.2%CVE-2026-110287MEDIUMImproper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with general EdiEPSS 0.2%CVE-2026-9590MEDIUMImproper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user withEPSS 0.2%CVE-2026-110804MEDIUMImproperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authentiEPSS 0.2%CVE-2026-119636HIGHImproper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.2EPSS 0.2%CVE-2026-0618MEDIUMCross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.EPSS 0.2%CVE-2023-2257MEDIUMAuthentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attEPSS 0.2%CVE-2026-3221MEDIUMSensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker wEPSS 0.2%CVE-2026-4829MEDIUMImproper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user tEPSS 0.2%CVE-2025-2528LOWImproper authorization in application password policy in Devolutions Remote Desktop Manager on Windows allows an authenticated user to use EPSS 0.2%CVE-2026-100287MEDIUMMissing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged userEPSS 0.2%CVE-2026-93332MEDIUMImproper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged usEPSS 0.2%CVE-2026-4989MEDIUMImproper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform seEPSS 0.2%CVE-2023-7047— Inadequate validation of permissions when employing remote tools and macros via the context menu within Devolutions Remote Desktop ManagerEPSS 0.2%CVE-2026-5146MEDIUMImproper access control in the notification management endpoints in Devolutions Server allows an unauthenticated attacker to modify or deletEPSS 0.2%CVE-2026-100289MEDIUMMissing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileEPSS 0.2%CVE-2022-3182—Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackersEPSS 0.2%CVE-2026-121580HIGHServer-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-prEPSS 0.2%CVE-2026-10787MEDIUMMissing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadataEPSS 0.2%