# Devolutions vulnerabilities Source: https://junglewise.ai/threats/vendors/devolutions Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/devolutions.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 67 vulnerabilities in Devolutions: 5 in the last 7 days and 30 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126332, was published on 11 November 2026. 14 vulnerabilities in the last four weeks, up 40% on the four before (10). 3 technologies have a page of their own. ## Counts - Last 7 days: 5 - Last 30 days: 19 - Last 90 days: 30 - All time: 67 (1 critical, 0 exploited in the wild) ## About Devolutions A Canadian software company specializing in remote connection management, password management, and privileged access management solutions. ## Latest Devolutions vulnerabilities - [CVE-2026-126332: Devolutions Server improper access control in autofill vault search](https://junglewise.ai/threats/cve-2026-126332-improper-access-control-in-the-autofill-vault-search-in) (info, published 11 Nov 2026) - [CVE-2026-126331: Devolutions Server sensitive information disclosure in user list endpoint](https://junglewise.ai/threats/cve-2026-126331-insertion-of-sensitive-information-into-sent-data-in-the-user) (info, published 11 Nov 2026) - [CVE-2026-126328: Devolutions Server sensitive information disclosure in user endpoints](https://junglewise.ai/threats/cve-2026-126328-insertion-of-sensitive-information-into-sent-data-in-the-user) (info, published 11 Nov 2026) - [CVE-2026-126327: Devolutions Server improper access control in connection history](https://junglewise.ai/threats/cve-2026-126327-improper-access-control-in-the-connection-history-in-devolutions) (info, published 11 Nov 2026) - [CVE-2026-126326: Devolutions Server privilege escalation via role assignment endpoint](https://junglewise.ai/threats/cve-2026-126326-improper-access-control-in-the-administrative-role-assignment) (info, published 11 Nov 2026) - [CVE-2026-121580: Devolutions Server server-side request forgery in Jira integration](https://junglewise.ai/threats/cve-2026-121580-server-side-request-forgery-in-the-jira-ticketing-filter-lookup) (info, published 3 Nov 2026) - [CVE-2026-120734: Devolutions Server cleartext transmission of SMTP password in email configuration test](https://junglewise.ai/threats/cve-2026-120734-cleartext-transmission-of-sensitive-information-in-the-email) (info, published 3 Nov 2026) - [CVE-2026-120733: Devolutions Server cleartext storage of TOTP secrets](https://junglewise.ai/threats/cve-2026-120733-cleartext-storage-of-sensitive-information-in-the-user-account) (info, published 3 Nov 2026) - [CVE-2026-120716: Devolutions Server sensitive information exposure in user synchronization](https://junglewise.ai/threats/cve-2026-120716-insertion-of-sensitive-information-into-sent-data-in-the) (info, published 3 Nov 2026) - [CVE-2026-120715: Devolutions Server SSRF in Active Directory credential validation](https://junglewise.ai/threats/cve-2026-120715-server-side-request-forgery-in-the-active-directory-credential) (info, published 3 Nov 2026) - [CVE-2026-119636: Devolutions Server privileged account access retention after checkout expiry](https://junglewise.ai/threats/cve-2026-119636-improper-release-of-expired-privileged-access-checkouts-in-the) (info, published 3 Nov 2026) - [CVE-2026-116627: Devolutions PowerShell Universal cross-site scripting in notifications](https://junglewise.ai/threats/cve-2026-116627-improper-neutralization-of-input-during-web-page-generation) (info, published 27 Oct 2026) - [CVE-2026-114487: Devolutions Server missing authorization in PAM AD import](https://junglewise.ai/threats/cve-2026-114487-missing-authorization-in-the-pam-ad-computer-import-endpoint-in) (info, published 22 Oct 2026) - [CVE-2026-114486: Devolutions Server authorization bypass in Gateway token generation](https://junglewise.ai/threats/cve-2026-114486-incorrect-authorization-in-the-devolutions-gateway-token) (info, published 22 Oct 2026) - [CVE-2026-114485: Devolutions Server MFA secret disclosure in user list endpoint](https://junglewise.ai/threats/cve-2026-114485-insufficient-protection-of-sensitive-information-in-the-user) (info, published 22 Oct 2026) - [CVE-2026-110806: Devolutions Server privilege escalation via add-on properties](https://junglewise.ai/threats/cve-2026-110806-incorrect-authorization-in-add-on-properties-in-devolutions) (medium, CVSS 6.5, published 16 Oct 2026) - [CVE-2026-110805: Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an…](https://junglewise.ai/threats/cve-2026-110805-server-side-request-forgery-in-pingone-groups-endpoint-in) (low, CVSS 2.6, published 16 Oct 2026) - [CVE-2026-110804: Devolutions Server PAM checkout privilege escalation](https://junglewise.ai/threats/cve-2026-110804-improperly-controlled-modification-of-jit-elevation-settings-in) (medium, CVSS 4.3, published 16 Oct 2026) - [CVE-2026-110287: Devolutions Server improper access control in asset contact password](https://junglewise.ai/threats/cve-2026-110287-improper-access-control-in-asset-contact-password-in-devolutions) (medium, CVSS 4.3, published 16 Oct 2026) - [CVE-2026-9226: Devolutions Server Azure AD authentication bypass](https://junglewise.ai/threats/cve-2026-9226-authentication-bypass-in-the-azure-ad-external-login-flow-in) (info, published 6 Oct 2026) - [CVE-2026-105488: Devolutions Server missing authorization in global vault](https://junglewise.ai/threats/cve-2026-105488-missing-authorization-in-the-global-vault-in-devolutions-server) (info, published 6 Oct 2026) - [CVE-2026-105485: Devolutions Server OAuth device authorization auth bypass](https://junglewise.ai/threats/cve-2026-105485-authentication-bypass-oauth-device-authorization-flow-in) (info, published 6 Oct 2026) - [CVE-2026-93332: Devolutions Server improper access control in partial connection API](https://junglewise.ai/threats/cve-2026-93332-improper-access-control-in-the-partial-connection-api-in) (info, published 29 Sep 2026) - [CVE-2026-93330: Devolutions Server PAM access control bypass in Active Directory provider](https://junglewise.ai/threats/cve-2026-93330-improper-rule-enforcement-in-the-pam-active-directory-provider-in) (medium, CVSS 4.3, published 29 Sep 2026) - [CVE-2026-100289: Devolutions Server missing authorization in gateway network scan token API](https://junglewise.ai/threats/cve-2026-100289-missing-authorization-in-the-gateway-network-scan-token-api-in) (medium, CVSS 5, published 29 Sep 2026) ## Most severe Devolutions vulnerabilities - [CVE-2026-2590: Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions…](https://junglewise.ai/threats/cve-2026-2590-improper-enforcement-of-the-disable-password-saving-in-vaults) (critical, CVSS 9.8, published 3 Mar 2026) - [CVE-2025-13757: SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through…](https://junglewise.ai/threats/cve-2025-13757-sql-injection-vulnerability-in-last-usage-logs-in-devolutions) (high, CVSS 8.8, published 27 Nov 2025) - [CVE-2025-11957: Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an…](https://junglewise.ai/threats/cve-2025-11957-improper-authorization-in-the-temporary-access-workflow-of) (high, CVSS 8.4, published 22 Oct 2025) - [CVE-2026-4924: Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier…](https://junglewise.ai/threats/cve-2026-4924-improper-authentication-in-the-two-factor-authentication-2fa) (high, CVSS 8.2, published 1 Apr 2026) - [CVE-2026-4828: Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote…](https://junglewise.ai/threats/cve-2026-4828-improper-authentication-in-the-oauth-login-functionality-in) (high, CVSS 8.2, published 1 Apr 2026) - [CVE-2026-9047: Devolutions Server MFA bypass in factor management feature](https://junglewise.ai/threats/cve-2026-9047-devolutions-server-mfa-bypass-in-factor-management-feature) (high, CVSS 7.6, published 22 May 2026) - [CVE-2026-10696: Devolutions UniGetUI incorrect package correlation in pinget backend](https://junglewise.ai/threats/cve-2026-10696-devolutions-unigetui-incorrect-package-correlation-in-pinget) (high, CVSS 7.5, published 17 Jun 2026) - [CVE-2025-13683: Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue…](https://junglewise.ai/threats/cve-2025-13683-exposure-of-credentials-in-unintended-requests-in-devolutions) (medium, CVSS 6.5, published 28 Nov 2025) - [CVE-2026-92237: Devolutions PowerShell Universal sensitive information disclosure in query logs](https://junglewise.ai/threats/cve-2026-92237-devolutions-powershell-universal-sensitive-information-disclosure) (medium, CVSS 6.5, published 15 Sep 2026) - [CVE-2026-4927: Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management…](https://junglewise.ai/threats/cve-2026-4927-exposure-of-sensitive-information-in-the-users-mfa-feature-in) (medium, CVSS 6.5, published 1 Apr 2026) ## Vulnerabilities per week 14 vulnerabilities in the last four weeks, up 40% on the four before (10). | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 1 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 6 | 0 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 4 | 0 | 0 | | 19 Oct 2026 | 3 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 6 | 0 | 0 | | 9 Nov 2026 | 5 | 0 | 0 | ## Devolutions technologies - [Devolutions Server](https://junglewise.ai/threats/technologies/devolutions-server): 51 vulnerabilities - [Devolutions PowerShell Universal](https://junglewise.ai/threats/technologies/powershell-universal): 9 vulnerabilities - [Devolutions Remote Desktop Manager](https://junglewise.ai/threats/technologies/remote-desktop-manager): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Devolutions vulnerabilities", https://junglewise.ai/threats/vendors/devolutions, 12 November 2026.