Portal 
Forum 
Devolutions Force 
Hub Business 
Hub Personal 
Devolutions Send 
Devolutions Academy 
RDM 
Workspace 
Launcher 
Security & Compliance
DEVO-2025-0014
Summary
Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.
Affected Products
Devolutions Server 2025.3.2 and earlier
Change Log
14/10/2025 - Initial publication
Severity
High
Products
Devolutions Server
Fix Version
2025.2.15, 2025.3.3
Lack of TLS domain validation when connecting to gateways
Description
The TLS certificate validation when connecting to a Devolutions Gateway failed to validate that the subject of the certificate matched the domain name of the host. This could allow attackers in a MitM position to intercept or tamper traffic between Devolutions Server and a Gateway.
The security of the sessions going through the gateway is not impacted, as the certificate is also validated on the endpoints when initiating a connection.
Remediation and Workarounds
Update to Devolutions Server 2025.3.3 or higher, 2025.2.15 or higher
Severity
7.7 High - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected Products
Devolutions Server 2025.3 and earlier
CVE(s)
CVE-2025-11619
