# Devolutions Server.

Every CVE that names Devolutions Server among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [Missing authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-4925.md)
  `CVE-2026-4925` · CVE record: Devolutions Server · CVSS 5.0 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Broken access control
- [Information disclosure in Devolutions Server](https://agentprime.io/advisories/CVE-2026-4927.md)
  `CVE-2026-4927` · CVE record: Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Information disclosure
- [Weak authentication in Devolutions Server](https://agentprime.io/advisories/CVE-2026-4924.md)
  `CVE-2026-4924` · CVE record: Devolutions Server · CVSS 8.2 High · Not analysed yet · Published 1 Apr 2026 · Tags: Authentication bypass
- [Weak authentication in Devolutions Server](https://agentprime.io/advisories/CVE-2026-4828.md)
  `CVE-2026-4828` · CVE record: Devolutions Server · CVSS 8.2 High · Not analysed yet · Published 1 Apr 2026 · Tags: Authentication bypass
- [Improper authentication in Devolutions Server](https://agentprime.io/advisories/CVE-2026-4829.md)
  `CVE-2026-4829` · CVE record: Devolutions Server · CVSS 5.4 Medium · Not analysed yet · Published 1 Apr 2026 · Tags: Authentication bypass
- [Improper certificate validation in Devolutions Server](https://agentprime.io/advisories/CVE-2026-4434.md)
  `CVE-2026-4434` · CVE record: Devolutions Server · CVSS 8.1 High · Not analysed yet · Published 20 Mar 2026 · Tags: Weak cryptography or TLS
- [Missing authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-3638.md)
  `CVE-2026-3638` · CVE record: Devolutions Server · CVSS 5.9 Medium · Not analysed yet · Published 9 Mar 2026 · Tags: Broken access control
- [Devolutions Server: Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier…](https://agentprime.io/advisories/CVE-2026-3130.md)
  `CVE-2026-3130` · CVE record: Devolutions Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-841
- [Improper input validation in Devolutions Server](https://agentprime.io/advisories/CVE-2026-3204.md)
  `CVE-2026-3204` · CVE record: Devolutions Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: CWE-20
- [Improper authentication in Devolutions Server](https://agentprime.io/advisories/CVE-2026-3224.md)
  `CVE-2026-3224` · CVE record: Devolutions Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Mar 2026 · Tags: Authentication bypass
- [Cleartext storage of sensitive information in Devolutions Server](https://agentprime.io/advisories/CVE-2026-3221.md)
  `CVE-2026-3221` · CVE record: Devolutions Server · CVSS 4.9 Medium · Not analysed yet · Published 25 Feb 2026 · Tags: Information disclosure
- [Information disclosure in Devolutions Server](https://agentprime.io/advisories/CVE-2026-3131.md)
  `CVE-2026-3131` · CVE record: Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Information disclosure
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-1768.md)
  `CVE-2026-1768` · CVE record: Devolutions Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 24 Feb 2026 · Tags: Broken access control
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-1007.md)
  `CVE-2026-1007` · CVE record: Devolutions Server · CVSS 7.6 High · Not analysed yet · Published 19 Jan 2026 · Tags: Broken access control
- [SQL injection in Devolutions Server](https://agentprime.io/advisories/CVE-2026-0610.md)
  `CVE-2026-0610` · CVE record: Devolutions Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Jan 2026 · Tags: SQL injection
- [Information disclosure in Devolutions Server and others](https://agentprime.io/advisories/CVE-2025-13683.md)
  `CVE-2025-13683` · CVE record: Devolutions Server and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 28 Nov 2025 · Tags: Information disclosure
- [Information disclosure in Devolutions Server](https://agentprime.io/advisories/CVE-2025-13758.md)
  `CVE-2025-13758` · CVE record: Devolutions Server · CVSS 3.5 Low · Not analysed yet · Published 27 Nov 2025 · Tags: Information disclosure
- [SQL injection in Devolutions Server](https://agentprime.io/advisories/CVE-2025-13757.md)
  `CVE-2025-13757` · CVE record: Devolutions Server · CVSS 8.8 High · Not analysed yet · Published 27 Nov 2025 · Tags: SQL injection
- [Information disclosure in Devolutions Server](https://agentprime.io/advisories/CVE-2025-13765.md)
  `CVE-2025-13765` · CVE record: Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 27 Nov 2025 · Tags: Information disclosure
- [Improper privilege management in Devolutions Server](https://agentprime.io/advisories/CVE-2025-12485.md)
  `CVE-2025-12485` · CVE record: Devolutions Server · CVSS 8.8 High · Not analysed yet · Published 6 Nov 2025 · Tags: Privilege escalation
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2025-12808.md)
  `CVE-2025-12808` · CVE record: Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 6 Nov 2025 · Tags: Broken access control
- [Insecure direct object reference in Devolutions Server](https://agentprime.io/advisories/CVE-2025-11957.md)
  `CVE-2025-11957` · CVE record: Devolutions Server · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2025 · Tags: Broken access control
- [Improper input validation in Devolutions Server](https://agentprime.io/advisories/CVE-2025-11958.md)
  `CVE-2025-11958` · CVE record: Devolutions Server · CVSS 5.1 Medium · Not analysed yet · Published 22 Oct 2025 · Tags: CWE-20
- [Improper certificate validation in Devolutions Server](https://agentprime.io/advisories/CVE-2025-11619.md)
  `CVE-2025-11619` · CVE record: Devolutions Devolutions Server · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2025 · Tags: Weak cryptography or TLS
- [Deadlock in Devolutions Server](https://agentprime.io/advisories/CVE-2025-8312.md)
  `CVE-2025-8312` · CVE record: Devolutions Server · CVSS 7.1 High · Not analysed yet · Published 30 Jul 2025 · Tags: Denial of service
- [Devolutions Server: UI synchronization issue in the Just-in-Time (JIT) access request approval interface in…](https://agentprime.io/advisories/CVE-2025-8353.md)
  `CVE-2025-8353` · CVE record: Devolutions Server · CVSS 5.9 Medium · Not analysed yet · Published 30 Jul 2025 · Tags: CWE-446
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2025-6741.md)
  `CVE-2025-6741` · CVE record: Devolutions Server · CVSS 7.1 High · Not analysed yet · Published 22 Jul 2025 · Tags: Broken access control
- [Weak credentials in Devolutions Server](https://agentprime.io/advisories/CVE-2025-6523.md)
  `CVE-2025-6523` · CVE record: Devolutions Server · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Jul 2025 · Tags: Hard-coded credentials
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2025-0691.md)
  `CVE-2025-0691` · CVE record: Devolutions Server · CVSS 5.0 Medium · Not analysed yet · Published 5 Jun 2025 · Tags: Broken access control
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2025-5382.md)
  `CVE-2025-5382` · CVE record: Devolutions Server · CVSS 6.8 Medium · Not analysed yet · Published 5 Jun 2025 · Tags: Broken access control
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2025-3768.md)
  `CVE-2025-3768` · CVE record: Devolutions Server · CVSS 5.0 Medium · Not analysed yet · Published 5 Jun 2025 · Tags: Broken access control
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2025-4433.md)
  `CVE-2025-4433` · CVE record: Devolutions Server · CVSS 8.7 High · Not analysed yet · Published 30 May 2025 · Tags: Broken access control
- [Devolutions Server: Improper privilege assignment in PAM JIT privilege sets in Devolutions Server allows a…](https://agentprime.io/advisories/CVE-2025-4493.md)
  `CVE-2025-4493` · CVE record: Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 28 May 2025 · Tags: Privilege escalation
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2025-4316.md)
  `CVE-2025-4316` · CVE record: Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 5 May 2025 · Tags: Broken access control
- [Devolutions Server: Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server…](https://agentprime.io/advisories/CVE-2025-3517.md)
  `CVE-2025-3517` · CVE record: Devolutions Devolutions Server · CVSS 6.3 Medium · Not analysed yet · Published 1 May 2025 · Tags: Privilege escalation
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2025-2280.md)
  `CVE-2025-2280` · CVE record: Devolutions Server · CVSS 8.1 High · Not analysed yet · Published 13 Mar 2025 · Tags: Broken access control
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2025-2278.md)
  `CVE-2025-2278` · CVE record: Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 13 Mar 2025 · Tags: Broken access control
- [Information disclosure in Devolutions Server](https://agentprime.io/advisories/CVE-2025-2277.md)
  `CVE-2025-2277` · CVE record: Devolutions Server · CVSS 7.5 High · Not analysed yet · Published 13 Mar 2025 · Tags: Information disclosure
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2025-2003.md)
  `CVE-2025-2003` · CVE record: Devolutions Server · CVSS 7.1 High · Not analysed yet · Published 5 Mar 2025 · Tags: Broken access control
- [Improper authentication in Devolutions Server](https://agentprime.io/advisories/CVE-2025-1231.md)
  `CVE-2025-1231` · CVE record: Devolutions Server · CVSS 5.4 Medium · Not analysed yet · Published 11 Feb 2025 · Tags: Authentication bypass
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2024-12148.md)
  `CVE-2024-12148` · CVE record: Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 4 Dec 2024 · Tags: Broken access control
- [Incorrect permission assignment in Devolutions Server](https://agentprime.io/advisories/CVE-2024-12151.md)
  `CVE-2024-12151` · CVE record: Devolutions Server · CVSS 5.0 Medium · Not analysed yet · Published 4 Dec 2024 · Tags: Broken access control
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2024-12196.md)
  `CVE-2024-12196` · CVE record: Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 4 Dec 2024 · Tags: Broken access control
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2024-6512.md)
  `CVE-2024-6512` · CVE record: Devolutions Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2024 · Tags: Broken access control
- [Authentication bypass by spoofing in Devolutions Server](https://agentprime.io/advisories/CVE-2024-4846.md)
  `CVE-2024-4846` · CVE record: Devolutions Server · CVSS 6.3 Medium · Not analysed yet · Published 25 Jun 2024 · Tags: Authentication bypass
- [Devolutions Server: Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0…](https://agentprime.io/advisories/CVE-2024-5072.md)
  `CVE-2024-5072` · CVE record: Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 17 May 2024
- [Devolutions Server: Improper permission handling in the vault offline cache feature in Devolutions Remote…](https://agentprime.io/advisories/CVE-2024-3545.md)
  `CVE-2024-3545` · CVE record: Devolutions Server and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 9 Apr 2024 · Tags: CWE-281
- [Devolutions Server: Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and…](https://agentprime.io/advisories/CVE-2024-2918.md)
  `CVE-2024-2918` · CVE record: Devolutions Server · CVSS 3.6 Low · Not analysed yet · Published 9 Apr 2024
- [Missing authentication in Devolutions Server](https://agentprime.io/advisories/CVE-2024-2921.md)
  `CVE-2024-2921` · CVE record: Devolutions Server · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Mar 2024 · Tags: Authentication bypass
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2024-2915.md)
  `CVE-2024-2915` · CVE record: Devolutions Server · CVSS 8.8 High · Not analysed yet · Published 26 Mar 2024 · Tags: Broken access control
- [Improper privilege management in Devolutions Server](https://agentprime.io/advisories/CVE-2024-1764.md)
  `CVE-2024-1764` · CVE record: Devolutions Server · CVSS 7.6 High · Not analysed yet · Published 5 Mar 2024 · Tags: Privilege escalation
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2024-1898.md)
  `CVE-2024-1898` · CVE record: Devolutions Server · CVSS 3.9 Low · Not analysed yet · Published 5 Mar 2024 · Tags: Broken access control
- [Devolutions Server: Improper session management in the identity provider authentication flow in Devolutions…](https://agentprime.io/advisories/CVE-2024-1900.md)
  `CVE-2024-1900` · CVE record: Devolutions Server · CVSS 5.5 Medium · Not analysed yet · Published 5 Mar 2024
- [Devolutions Server: Denial of service in PAM password rotation during the check-in process in Devolutions…](https://agentprime.io/advisories/CVE-2024-1901.md)
  `CVE-2024-1901` · CVE record: Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 5 Mar 2024
- [Devolutions Server: Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0…](https://agentprime.io/advisories/CVE-2023-6264.md)
  `CVE-2023-6264` · CVE record: Devolutions Server · No CVSS score · Not analysed yet · Published 22 Nov 2023
- [Devolutions Server: Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0…](https://agentprime.io/advisories/CVE-2023-5358.md)
  `CVE-2023-5358` · CVE record: Devolutions Devolutions Server · No CVSS score · Not analysed yet · Published 1 Nov 2023
- [Devolutions Server: Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0…](https://agentprime.io/advisories/CVE-2023-5575.md)
  `CVE-2023-5575` · CVE record: Devolutions Server · No CVSS score · Not analysed yet · Published 16 Oct 2023
- [Improper access control in Devolutions Server](https://agentprime.io/advisories/CVE-2023-5240.md)
  `CVE-2023-5240` · CVE record: Devolutions Server · No CVSS score · Not analysed yet · Published 13 Oct 2023 · Tags: Broken access control
- [Incomplete cleanup in Devolutions Server](https://agentprime.io/advisories/CVE-2023-2400.md)
  `CVE-2023-2400` · CVE record: Devolutions Server · CVSS 2.7 Low · Not analysed yet · Published 20 Jun 2023 · Tags: CWE-459
- [Origin validation error in Devolutions Server](https://agentprime.io/advisories/CVE-2023-2445.md)
  `CVE-2023-2445` · CVE record: Devolutions Devolutions Server · CVSS 4.9 Medium · Not analysed yet · Published 2 May 2023 · Tags: CWE-346

Newest: <https://agentprime.io/advisories/technology/devolutions-server.md>
Older: <https://agentprime.io/advisories/technology/devolutions-server.md?cursor=WyIyMDIzLTA1LTAyVDEzOjExOjA2LjQwNTAwMFoiLCJDVkUtMjAyMy0yNDQ1Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=devolutions-server&cursor=WyIyMDI2LTA0LTAxVDE1OjA0OjIyLjEzMDAwMFoiLCJDVkUtMjAyNi01MTc1Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/devolutions-server/?cursor=WyIyMDI2LTA0LTAxVDE1OjA0OjIyLjEzMDAwMFoiLCJDVkUtMjAyNi01MTc1Il0>. Everything for agents: <https://agentprime.io/llms.txt>.