https://cvebrief.com/archive/cves/vendor/devolutions/ High and critical Devolutions vulnerabilities covered by CVE Brief, with independent analyst commentary. en-us Sun, 16 Aug 2026 12:00:00 GMT https://cvebrief.com/cve/cve-2026-19768/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-19768 Sun, 16 Aug 2026 12:00:00 GMT Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026 Fix documented: 2026.2.4 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-17568/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-17568 Wed, 29 Jul 2026 12:00:00 GMT Improper access control in the role membership management endpoint in Devolutions Server allows an authenticated non-administrative user holding the user-group membership management permission to escalate privileges to administrator via a crafted API request Fix documented: 2026.1.24 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-16800/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-16800 Sat, 25 Jul 2026 12:00:00 GMT Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026 Fix documented: 2026.2.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-16801/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-16801 Sat, 25 Jul 2026 12:00:00 GMT Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026 Fix documented: 2026.2.3 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-15637/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-15637 Mon, 20 Jul 2026 12:00:00 GMT Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the creden Fix documented: 2026.1.23 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-15641/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-15641 Mon, 20 Jul 2026 12:00:00 GMT Improper authorization in the access request status endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to approve their own pending access request via a direct call to the request status endpoint, bypassing the required approver review Fix documented: 2026.1.23 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-14536/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-14536 Sat, 11 Jul 2026 12:00:00 GMT Devolutions Server 2026.2.4.0 through 2026.2.9.0 fails to enforce mandatory multi-factor authentication (MFA) policies when encountering invalid default values, allowing credentialed bypass. Fix documented: 2026.2.9 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-12161/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-12161 Wed, 17 Jun 2026 12:00:00 GMT Improper input validation in the SSH Elevate Shell feature in Devolutions Remote Desktop Manager 2026 Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-4828/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-4828 Thu, 02 Apr 2026 12:00:00 GMT Improper authentication in the OAuth login functionality in Devolutions Server 2026 Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-4924/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-4924 Thu, 02 Apr 2026 12:00:00 GMT Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026 Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-4396/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-4396 Thu, 19 Mar 2026 12:00:00 GMT Improper certificate validation in Devolutions Hub Reporting Service 2025 Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-4064/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-4064 Wed, 18 Mar 2026 12:00:00 GMT Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026 Fix documented: 2026.1.4 (CVE record). Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2026-1007/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2026-1007 Wed, 21 Jan 2026 12:00:00 GMT Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-12485/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2025-12485 Thu, 06 Nov 2025 12:00:00 GMT Improper privilege management during pre-MFA cookie handling in Devolutions Server 2025 Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-11957/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2025-11957 Wed, 22 Oct 2025 12:00:00 GMT Improper authorization in the temporary access workflow of Devolutions Server 2025 Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-11619/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2025-11619 Wed, 15 Oct 2025 12:00:00 GMT Improper certificate validation when connecting to gateways in Devolutions Server 2025 Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-8312/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2025-8312 Wed, 30 Jul 2025 12:00:00 GMT Deadlock in PAM automatic check-in feature in Devolutions Server allows a password to remain valid beyond the end of its intended check-out period due to a deadlock occurring in the scheduling service Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-6523/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2025-6523 Wed, 23 Jul 2025 12:00:00 GMT Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by the server within a feasible timeframe Independent analyst report on CVE Brief. https://cvebrief.com/cve/cve-2025-6741/?utm_source=cvebrief&utm_medium=rss&utm_campaign=vendor-feed cvebrief-devolutions-CVE-2025-6741 Wed, 23 Jul 2025 12:00:00 GMT Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entry attachment feature This issue affects the following versions : * Devolutions Server 2025 Independent analyst report on CVE Brief.