Vendor
Devolutions vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 67 vulnerabilities in Devolutions: 5 in the last 7 days and 30 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126332, was published on 11 November 2026. 14 vulnerabilities in the last four weeks, up 40% on the four before (10). 3 technologies have a page of their own.
- Last 7 days
- 5
- Last 90 days
- 30
- Critical, all time
- 1
- Exploited in the wild
- 0
About Devolutions
A Canadian software company specializing in remote connection management, password management, and privileged access management solutions.
Devolutions technologies
Latest Devolutions vulnerabilities
- CVE-2026-126332: Devolutions Server improper access control in autofill vault searchinfo
- CVE-2026-126331: Devolutions Server sensitive information disclosure in user list endpointinfo
- CVE-2026-126328: Devolutions Server sensitive information disclosure in user endpointsinfo
- CVE-2026-126327: Devolutions Server improper access control in connection historyinfo
- CVE-2026-126326: Devolutions Server privilege escalation via role assignment endpointinfo
- CVE-2026-121580: Devolutions Server server-side request forgery in Jira integrationinfo
- CVE-2026-120734: Devolutions Server cleartext transmission of SMTP password in email configuration testinfo
- CVE-2026-120733: Devolutions Server cleartext storage of TOTP secretsinfo
- CVE-2026-120716: Devolutions Server sensitive information exposure in user synchronizationinfo
- CVE-2026-120715: Devolutions Server SSRF in Active Directory credential validationinfo
- CVE-2026-119636: Devolutions Server privileged account access retention after checkout expiryinfo
- CVE-2026-116627: Devolutions PowerShell Universal cross-site scripting in notificationsinfo
- CVE-2026-114487: Devolutions Server missing authorization in PAM AD importinfo
- CVE-2026-114486: Devolutions Server authorization bypass in Gateway token generationinfo
- CVE-2026-114485: Devolutions Server MFA secret disclosure in user list endpointinfo
- CVE-2026-110806: Devolutions Server privilege escalation via add-on propertiesmediumCVSS 6.5EPSS 0.2%
- CVE-2026-110805: Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an…lowCVSS 2.6EPSS 0.1%
- CVE-2026-110804: Devolutions Server PAM checkout privilege escalationmediumCVSS 4.3
- CVE-2026-110287: Devolutions Server improper access control in asset contact passwordmediumCVSS 4.3
- CVE-2026-9226: Devolutions Server Azure AD authentication bypassinfo
- CVE-2026-105488: Devolutions Server missing authorization in global vaultinfo
- CVE-2026-105485: Devolutions Server OAuth device authorization auth bypassinfo
- CVE-2026-93332: Devolutions Server improper access control in partial connection APIinfo
- CVE-2026-93330: Devolutions Server PAM access control bypass in Active Directory providermediumCVSS 4.3
- CVE-2026-100289: Devolutions Server missing authorization in gateway network scan token APImediumCVSS 5
Most severe Devolutions vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-2590: Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions…criticalCVSS 9.8
- CVE-2025-13757: SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through…highCVSS 8.8EPSS 0.6%
- CVE-2025-11957: Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an…highCVSS 8.4EPSS 0.3%
- CVE-2026-4924: Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier…highCVSS 8.2EPSS 0.3%
- CVE-2026-4828: Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote…highCVSS 8.2EPSS 0.3%
- CVE-2026-9047: Devolutions Server MFA bypass in factor management featurehighCVSS 7.6EPSS 0.2%
- CVE-2026-10696: Devolutions UniGetUI incorrect package correlation in pinget backendhighCVSS 7.5EPSS 0.3%
- CVE-2025-13683: Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue…mediumCVSS 6.5EPSS 0.4%
- CVE-2026-92237: Devolutions PowerShell Universal sensitive information disclosure in query logsmediumCVSS 6.5EPSS 0.4%
- CVE-2026-4927: Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management…mediumCVSS 6.5EPSS 0.2%
Vulnerabilities per week
14 vulnerabilities in the last four weeks, up 40% on the four before (10). The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 1 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 1 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 6 | 0 | |
| 5 Oct 2026 | 3 | 0 | |
| 12 Oct 2026 | 4 | 0 | |
| 19 Oct 2026 | 3 | 0 | |
| 26 Oct 2026 | 1 | 0 | |
| 2 Nov 2026 | 6 | 0 | |
| 9 Nov 2026 | 5 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Devolutions vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/vendors/devolutions)<a href="https://junglewise.ai/threats/vendors/devolutions"><img src="https://junglewise.ai/threats/vendors/devolutions/badge.svg" alt="Devolutions vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/devolutions.json, and this page as text at https://junglewise.ai/threats/vendors/devolutions.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Devolutions vulnerabilities", https://junglewise.ai/threats/vendors/devolutions, 12 November 2026.