Threat database

CVE-2026-114487 is a missing authorization vulnerability in Devolutions Server affecting versions 2026.3.5.0 through 2026.3.10.0 and all versions up to 2026.2.20.0. It allows an authenticated non-administrative user with a PAM license to create PAM sub-providers under existing Active Directory providers by sending a crafted import request to the PAM AD computer import endpoint.

CVE-2026-114486 is an incorrect authorization vulnerability in Devolutions Server affecting versions prior to 2026.3.11. It allows an authenticated non-administrative user to bypass Network Access Rules on a virtual gateway by exploiting the token generation process, enabling access to hosts that should be denied.

A vulnerability in Devolutions Server versions 2026.3.10.0 and earlier allows an authenticated attacker with delegated user view permissions to access MFA secrets of all users via the user list API. This issue stems from insufficient protection of sensitive information in the user list endpoint.

CVE-2026-110805 is a server-side request forgery (SSRF) vulnerability in the PingOne groups endpoint of Devolutions Server versions 2026.3.8.0 and earlier. It allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret by manipulating the PingOne configuration in a request parameter. The vulnerability has a low CVSS score of 2.6, indicating limited impact and requiring user interaction with high attack complexity.

CVE-2026-110804 is a vulnerability in Devolutions Server versions prior to 2026.3.10 that allows an authenticated user with PAM checkout access to improperly modify JIT elevation settings. This flaw can enable deletion of arbitrary Active Directory groups or retention of elevated privileges through client-supplied JIT elevation settings in a checkout update request.

CVE-2026-110806 is an incorrect authorization vulnerability in Devolutions Server versions 2026.3.8.0 and earlier. It allows an authenticated user with only View permission to access unredacted add-on passwords through add-on properties returned in connection data. This vulnerability does not require user interaction and has a medium severity rating with a CVSS score of 6.5.

CVE-2026-110287 is an improper access control vulnerability in Devolutions Server versions prior to 2026.3.10. It allows an authenticated user who has general Edit permissions but lacks Edit asset permission to modify the asset contact password by sending a crafted request to the partial-save endpoint. The vulnerability has a CVSS score of 4.3, indicating medium severity.

CVE-2026-105488 is a missing authorization vulnerability in Devolutions Server versions 2026.3.7.0 and earlier. It allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries. This flaw affects versions prior to 2026.3.8. The vulnerability has a high severity rating with a CVSS score of 7.1.

CVE-2026-105485 is an authentication bypass vulnerability in Devolutions Server versions 2026.3.7.0 and earlier. It affects the OAuth device authorization flow, allowing a remote attacker to take over a user's account by replaying a captured device verification link. The vulnerability requires user interaction (UI:R) and has a medium severity with a CVSS score of 6.8.

CVE-2026-9226 is an authentication bypass vulnerability in Devolutions Server affecting versions before 2026.3.8.0. It involves the Azure AD external login flow, where an attacker can replay a captured login-session token exposed in a redirect URL to take over a user's account. The vulnerability has a medium severity with a CVSS score of 6.8. A patch is available, and the product is a cloud service, so the vendor manages remediation.

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.

CVE-2026-100288 is a vulnerability in Devolutions Server versions prior to 2026.3.7.0 where sensitive information, including external identity provider tokens and active session identifiers, is stored in cleartext within the database. An attacker with read access to the database can directly inspect these records to obtain this sensitive data. The vulnerability has a high severity with a CVSS score of 7.2.

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.

Missing authorization in the data source settings API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.

CVE-2026-93332 is a medium severity vulnerability in Devolutions Server versions prior to 2026.3.7.0. It involves improper access control in the partial connection API, allowing an authenticated low-privileged user to read, create, modify, and delete System Vault entries. This vulnerability does not require user interaction and has a network attack vector.

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

CVE-2026-92237 is a vulnerability in Devolutions PowerShell Universal versions up to 2026.2.5 where sensitive information is inserted into log files by the slow query logging feature. Authenticated users with log read permissions can access application tokens, data protection keys, and other stored credentials via SQL parameter values recorded in system logs on Microsoft SQL Server-backed instances. The vulnerability has a medium severity rating with a CVSS score of 6.5.

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate.

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate.

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters.