Server

Every one of the 117 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to the PAM to access unauthorized PAM entri…CVE-2024-2921Devolutions · CVSS 9.8 · 0.8% likely

   CWE-306

2. Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user to access entries via…CVE-2023-5575Devolutions · 0.8% likely
3. Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PAM propagation scripts to retrieve passw…CVE-2023-5240Devolutions · 0.7% likely

   CWE-284

4. Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT elevation feature to m…CVE-2024-5072Devolutions · CVSS 6.5 · 0.7% likely
5. Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to elevate themselves to un…CVE-2024-2915Devolutions · CVSS 8.8 · 0.6% likely

   CWE-863

6. SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8.CVE-2025-13757Devolutions · CVSS 8.8 · 0.6% likely

   CWE-89

7. Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users with restricted rights to bypass entry perm…CVE-2023-1603Devolutions · CVSS 6.5 · 0.6% likely

   CWE-863

8. Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafte…CVE-2026-3204Devolutions · CVSS 9.8 · 0.6% likely

   CWE-20

9. Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-M…CVE-2025-12485Devolutions · CVSS 8.8 · 0.6% likely

   CWE-269

10. Improper access control in user group management in Devolutions Server 2025.1.7.0 and earlier allows a non-administrative user with both "User Management" and "User Group Manageme…CVE-2025-4433Devolutions · CVSS 8.8 · 0.6% likely

    CWE-284

11. Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an a…CVE-2026-3224Devolutions · CVSS 9.8 · 0.6% likely

    CWE-287

12. Exposure of password in web-based SSH authentication component in Devolutions Server 2024.3.13 and earlier allows a user to unadvertently leak his SSH password due to missing pass…CVE-2025-2277Devolutions · CVSS 7.5 · 0.6% likely

    CWE-200

13. Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configured Devolutions Gateways endpoints.CVE-2023-6264Devolutions · 0.5% likely

    CWE-200

14. Improper access control in web extension restriction feature in Devolutions Server 2024.3.4.0 and earlier allows an authenticated user to bypass the browser extension restriction…CVE-2025-2280Devolutions · CVSS 8.1 · 0.5% likely

    CWE-284

15. Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is…CVE-2026-3130Devolutions · CVSS 9.8 · 0.5% likely

    CWE-841

16. Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergen…CVE-2025-6523Devolutions · CVSS 7.7 · 0.5% likely

    CWE-1391

17. UI synchronization issue in the Just-in-Time (JIT) access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain un…CVE-2025-8353Devolutions · CVSS 5.9 · 0.5% likely

    CWE-446

18. Incorrect authorization in the permission component in Devolutions Server 2024.3.7.0 and earlier allows an authenticated user to view the password history of an entry without the…CVE-2024-12196Devolutions · CVSS 6.5 · 0.5% likely

    CWE-863

19. Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with c…CVE-2026-119636Devolutions · CVSS 8.8 · 0.5% likely

    CWE-772

20. Improper access control in temporary access requests and checkout requests endpoints in Devolutions Server 2024.3.13 and earlier allows an authenticated user to access information…CVE-2025-2278Devolutions · CVSS 6.5 · 0.5% likely

    CWE-284

21. An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to…CVE-2025-11958Devolutions · CVSS 4.1 · 0.4% likely

    CWE-20

22. Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission.CVE-2025-2003Devolutions · CVSS 7.1 · 0.4% likely

    CWE-863

23. Improper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and earlier allows an administrator to view users vaults of deleted users via database…CVE-2023-2400Devolutions · CVSS 2.7 · 0.4% likely

    CWE-459

24. Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entry attachment featur…CVE-2025-6741Devolutions · CVSS 7.7 · 0.4% likely

    CWE-284

25. Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclos…CVE-2025-12808Devolutions · CVSS 6.5 · 0.4% likely

    CWE-284

26. Improper enforcement of a mandatory multi-factor authentication policy in Devolutions Server 2026.2.9.0 allows an attacker with valid user credentials to bypass the MFA Required p…CVE-2026-14536Devolutions · CVSS 7.3 · 0.4% likely

    CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.