devolutions has 33 CVEs on record between 2025 and 2026. Disclosure cadence is accelerating: 22 in the last 90 days against 6 in the 90 before. The busiest recent month was September 2026 with 11. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (5) and CWE-863 (5). Most affected products: Server (20), devolutions_server (9), PowerShell Universal (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 22 prev 6
Products
- Server 20
- devolutions_server 9
- PowerShell Universal 2
- password_manager 1
- powershell_universal 1
Worst active — by depth score
CVE-2025-12485High· 8.8Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFA cookie.This does not bypass the target account MFA veri…49CVE-2025-11619High· 8.8Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.48CVE-2026-13327High· 8.3Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controll…46CVE-2025-11957High· 8.4Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access…46CVE-2026-8497High· 7.4Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive informa…41
devolutions vulnerabilities
CVEs affecting devolutions, newest first. Open any entry for full detail, references, and exploit status.
33 CVEsRSS
CVE-2025-11958Medium· 4.1An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request.
An improper input validation in the Security Dashboard ignored-tasks API of Devolutions Server 2025.2.15.0 and earlier allows an authenticated user to cause a denial of service to the Security Dashboard via a crafted request.
CVE-2025-11957High· 8.4Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access…
Improper authorization in the temporary access workflow of Devolutions Server 2025.2.12.0 and earlier allows an authenticated basic user to self-approve or approve the temporary access requests of other users and gain unauthorized access…
CVE-2025-11619High· 8.8Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.
Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.