MAIN MENU
Solutions

Packages

Remote desktop
management & IT operations

Boost productivity, decrease costs, and increase security with a centralized platform where you can manage a wide range of remote connections and tools.

Workforce password management

Improve your security strategy without reducing productivity by using a password management solution.

Privileged access
management

Diminish the risk of insider threats and cyberattacks while providing audit and compliance requirements for your team.

Remote access
management

Establish a secure entry point for internal or external segmented networks that require authorized just-in-time (JIT) access.

IT automation with PowerShell Universal

Streamline routine IT tasks and boost productivity with integrated scripting, orchestration, and reporting.

blue box
Starter Pack

The whole power of Devolutions half price for teams of 5

Proof of concept: 100+ users?

Quick overview

Compliance

Your trusted partner in security and compliance.

Integration center

Unified solutions: seamless integrations with Devolutions

Compare our solution packages Visit store & get a quote
Products
Products
Devolutions
Remote Desktop Manager

The best remote connection manager in the industry

Devolutions Password Manager

All-in-one application to securely access, manage, and use your credentials.

UniGetUI
UniGetUI Open source

Discover, install, and update all your Windows packages

Devolutions PowerShell Universal
Devolutions PowerShell Universal

Automate remote management with dashboards and APIs

Privileged access
Devolutions PAM

Secure, rotate, and audit every privileged account across your infrastructure

Companion tools
Devolutions Gateway
Devolutions Gateway Secure remote access — no VPN required
Devolutions Launcher
Devolutions Launcher Remote connection launching tool
Devolutions Agent
Devolutions Agent System service to control privileged operations
Online service
Devolutions Send
Devolutions Send Sharing secrets made quick, secure, and simple
Start for free
Resources
Resources
Academy

Your FREE go-to hub for mastering Devolutions' suite of products and services.

Forum

The Devolutions Forum is the place to go to connect with your peers and the Devolutions team.

Documentation

Get answers to product specifications, settings and more on our documentation.

Blog

Stay up to date with our weekly articles on our blog, the toolbox for your IT success.

On-demand Lab
Success stories
Reports & White papers
Learn a quick tip in 5 minutes! Browse feature requests
Company
About
Devolutions Ecosystem Timeline
Media
Devolutions logo Wallpapers
Careers
Welcome Available positions Spontaneous applications
Newsroom
Press releases Newsletters In the news Webinars
Security & compliance
Security Advisories Trust center Legal & privacy Report a security issue
Contact
Send message Send message Call me Call me
Technical support Sales Contact information

Security & compliance

Upholding the highest standards to protect your data and ensure trust.

Back to listing

DEVO-2026-0034

Devolutions Server is affected by multiple vulnerabilities.

Affected Products

Devolutions Server
2026.3.5.0 and earlier

Change Log

Initial publication - 2026-09-29

Cleartext storage of authentication and session tokens

6.9 Medium - CVSS:4.0/AV:L/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Cleartext storage of sensitive information in the database in Devolutions Server allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records.

CVE(s)

CVE-2026-100288

Remediation and Workarounds

Upgrade to Devolutions Server 2026.2.18.0 or 2026.3.7.0 or higher.

Missing authorization on integration settings endpoint

6.5 Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Missing authorization in the data source settings API in Devolutions Server allows an authenticated non-administrative user to disclose integration secrets via a crafted API request.

CVE(s)

CVE-2026-100286

Remediation and Workarounds

Upgrade to Devolutions Server 2026.2.18.0 or 2026.3.7.0 or higher.

Credits

dorjoo

Improper access control on System Vault partial connection endpoints

5.4 Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Improper access control in the partial connection API in Devolutions Server allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request.

CVE(s)

CVE-2026-93332

Remediation and Workarounds

Upgrade to Devolutions Server 2026.2.18.0 or 2026.3.7.0 or higher.

Credits

rizalyeswehack

Missing authorization on attachment history endpoints

5.4 Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Missing authorization in the attachment history API in Devolutions Server allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request.

CVE(s)

CVE-2026-100287

Remediation and Workarounds

Upgrade to Devolutions Server 2026.2.18.0 or 2026.3.7.0 or higher.

Credits

rizalyeswehack

Missing authorization on gateway network scan token endpoint

5 Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N

Missing authorization in the gateway network scan token API in Devolutions Server allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request.

CVE(s)

CVE-2026-100289

Remediation and Workarounds

Upgrade to Devolutions Server 2026.2.18.0 or 2026.3.7.0 or higher.

Credits

abfe

Incorrect behavior order bypasses the Devolutions Gateway host ruleset

2.3 Low - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N

Improper rule enforcement in the PAM Active Directory provider in Devolutions Server 2026.3.5 allows a user with PAM edit permissions to bypass the Devolutions Gateway host ruleset.

CVE(s)

CVE-2026-93330

Remediation and Workarounds

Upgrade to Devolutions Server 2026.2.18.0 or 2026.3.7.0 or higher.