Portal 
Forum 
Devolutions Force 
Hub Business 
Hub Personal 
Devolutions Send 
Devolutions Academy 
RDM 
Workspace 
Launcher 
Security & compliance
Upholding the highest standards to protect your data and ensure trust.
DEVO-2025-0018
Devolutions Server is affected by multiple vulnerabilities.
Affected Products
Change Log
2025-11-27 - Initial publication
9.4 Critical - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SQL injection in last usage logs
An SQL injection via the DateSortField parameter in last usage logs allows authenticated users to exfiltrate or modify data.
Affected Products
CVE(s)
CVE-2025-13757
Remediation and Workarounds
Upgrade to Devolutions Server 2025.2.21 or higher, 2025.3.9 or higher.
Credits
Medium 5.1 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Credentials included in partial connection requests
Entries in DVLS are requested in two separate requests, the first request contains general information to be displayed such as the name, username, creation date etc. Credentials such as passwords are fetched via a /sensitive-data request when the credential is accessed by the user. Some entry types improperly included passwords in the first request.
Affected Products
CVE(s)
CVE-2025-13758
Remediation and Workarounds
Upgrade to Devolutions Server 2025.2.21 or higher; 2025.3.9 or higher.
Credits
4.9 Medium - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:H/SA:N
Improper access control in email service component
The email service configuration API returned email service passwords to users without administrative rights when multiple email services where configured.
Affected Products
CVE(s)
CVE-2025-13765
Remediation and Workarounds
Upgrade to Devolutions Server 2025.2.21 or higher; 2025.3.9 or higher
