RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version
Security
10
CVE-2026-100286 Core - Fixed integration secrets in data source settings being visible to users without administrative permissions
CVE-2026-100287 Core - Fixed an issue where low-privileged users could restore and permanently delete vault attachments through attachment history
CVE-2026-100288 Core - Fixed authentication and session tokens being stored unencrypted in the database
CVE-2026-100289 Gateway - Fixed a security issue where any authenticated user could obtain a network scan token and access internal network information
CVE-2026-93332 Core - Fixed missing access controls that allowed users without the required permissions to read or save System Vault entries
Core - Fixed a security issue where the legacy partial login endpoint accepted and retained client-supplied session identifiers after authentication
Core - Fixed a SQL injection vulnerability in the database backup path setting
Core - Fixed the Microsoft Entra ID application secret being exposed in URL query strings when retrieving groups and role templates
PAM - Fixed the legacy WinRM client mode ignoring the "Skip TLS certificate validation" setting and always skipping certificate validation for HTTPS hosts
CVE-2026-93330 PAM - Fixed domain controller detection occurring before the Devolutions Gateway ruleset was enforced, allowing network traffic to bypass the ruleset and gateway logging
Improvements
1
Core - Added an option to import legacy roles that were not created during migration, allowing them to be used in role assignments
Fixes
11
Core - Fixed an error when filtering or sorting Administration logs by user on SQL Server databases using case-sensitive collation
Core - Fixed the "dvls-admin" user on Basic installations being able to bypass the required password change by closing the browser
Core - Fixed the Public API returning a 404 error instead of a 400 error for malformed request bodies
Core - Fixed users without System Vault entry edit permission being able to edit System Vault entries through their regular entry permissions
Gateway - Fixed an issue where "Force Gateway rulesets" could be bypassed when a connection explicitly targeted a physical gateway
Gateway - Fixed rejected Devolutions Gateway certificates being incorrectly reported as unreachable domain controllers in Active Directory domain configurations
PAM - Fixed Active Directory and Windows providers being unable to use a Devolutions Gateway in LDAPS mode with an already trusted certificate
Web - Fixed notification settings not being saved when exactly two available actions were selected
Web - Fixed renamed custom field titles not being retained when confirmed with the checkmark in the entry edit dialog
Web - Fixed trailing spaces being saved in tags and "Exact expression" notification subscription filters despite appearing to be removed in the interface
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.3 is required for this DVLS version
Security
1
PAM - Gateway rulesets are now enforced before detecting the domain controller
Improvements
4
Core - Password generation now honors custom characters defined in Devolutions Cloud password policies
Core - Updated Public API vault type filters to correctly filter PAM vaults
PAM - PAM license auto-assignment now considers provider-level role permissions
Web - Users can now launch sessions without the "View password" permission
Fixes
29
Core - Fixed an issue where Devolutions Send attachments were incorrectly limited to 1 MB instead of 30 MB
Core - Fixed an issue where Devolutions Send emails were not sent from Remote Desktop Manager
Core - Fixed an issue where Devolutions Send failed from Remote Desktop Manager when DVLS did not have a valid license
Core - Fixed an issue where moving a single entry to another vault placed it at the vault root instead of preserving its source folder
Core - Fixed an issue where non-admin users did not receive the "Warn if already opened" prompt and closed RDP sessions remained marked as open
Core - Fixed an issue where privileged account entries with a missing provider link loaded indefinitely without feedback
Core - Fixed an issue where roles assigned to the "Everyone" user group were not applied to all users
Core - Fixed an issue where scheduled Active Directory synchronization did not work with linked vault credentials
Core - Fixed an issue where the "Allow drag and drop" setting remained set to "None" and "Primary workspace owner" was not applied
Core - Fixed an issue where trailing spaces were saved in tags and the "Exact expression" notification subscription parameter
Core - Fixed Domain authentication and PAM Domain Provider failures after an upgrade when the domain controller's LDAPS certificate was not trusted by the DVLS server
Core - Fixed errors when granting permissions to user groups
Core - Fixed intermittent Linux build failures in the CI pipeline
Core - TLS certificate validation is now enforced when connecting to Active Directory
Gateway - Fixed an error when trusting a gateway certificate on DVLS running under Kestrel
Gateway - Fixed an issue with certificates stored in the Windows certificate store
Multiple UI fixes
PAM - Fixed a TLS certificate error when browsing containers from the quick start
PAM - Fixed an error when browsing domain containers during a quick scan
PAM - Fixed an incorrect launcher message when a contractor lacked the required permissions on a PAM vault or entry
PAM - Fixed an issue when assigning an Active Directory user as a reviewer
PAM - Fixed an issue where moving an entry to a vault failed when the destination path was a folder
PAM - Fixed an issue where the PostgreSQL provider was missing from the quick start
PAM - Fixed an issue where updating a provider's managed account corrupted its password
PAM - Fixed an issue where usage policies could be bypassed using inherited credentials
PAM - Fixed the Import button activation in delta scan results
Web - Fixed a scrolling issue on the PAM providers page
Web - Fixed a WebSocket connection leak when terminal sessions were closed by the server
Web - Updated the Telnet web client to fix terminal teardown and resizing issues
Core - Added PostgreSQL support as a Devolutions Server database backend
PAM - Added an option to keep Microsoft 365 and Active Directory JIT accounts between checkouts
PAM - Added self-rotation for PAM provider credentials
PAM - Added the ability to extend active PAM checkouts without checking in and requesting access again
PAM - Merged PAM and shared vaults, allowing PAM credentials to be stored in regular high-security vaults
Web - Added a compact kiosk view displaying web-launchable sessions as tiles
Improvements
32
Core - Added a setting to configure how long log files are retained on disk
Core - Added checkout support for folders and multiple selections
Core - Added expiration dates for user accounts
Core - Added missing Remote Desktop Manager variables so scripts and entries now resolve them correctly
Core - Added paging for large Active Directory group lists used by automatic user creation filters
Core - Added SSH key support to Bitwarden synchronization
Core - Added the ability to check out linked entries directly from the overview
Core - Hidden the "Submit a support ticket" action when internet features are disabled
Core - Imports now warn about entries with forbidden or policy-violating passwords instead of blocking them
Core - Improved performance when moving entries to vaults containing thousands of entries
Core - Improved support for vault templates when saving system settings
Core - Linked credentials are now automatically checked out when used
Core - Prevented connection logs linked to session recordings from being archived or purged
Core - Removed unusable PSU licenses from the interface
Core - Trimmed leading and trailing spaces from usernames during emergency login
PAM - Added a dedicated permission for manually creating PAM accounts
PAM - Added an option to skip TLS validation for the Windows provider
PAM - Added AnyIdentity provider support through Devolutions Gateway and on Linux using cross-platform PowerShell remoting
PAM - Added on-demand account discovery directly from the PAM providers list
PAM - Added visibility of inherited checkout policy values
Web - Added a session recording log viewer with an activity timeline
Web - Added support for DVLS Privileged Account credentials
Web - Added the "Allow password in variable" security setting to username and password credentials
Web - Added the ability to delete multiple attachments at once
Web - Added the ability to download multi-part session recordings as a single ZIP file
Web - Added the ability to run saved Scripts/Macros entries in web PowerShell and SSH terminals
Web - Added the ability to run scripts in PowerShell sessions opened through Devolutions Gateway
Web - Converted legacy Website entries to the current entry type
Web - Improved AI Assistant answer and approval prompt positioning
Web - Improved the search and advanced search experience
Web - Refreshed the user menu side panel layout
Web - Restored ticketing administration for Jira, ServiceNow, and HaloPSA
Fixes
48
Core - Fixed a SQL timeout when renaming folders containing more than 3,500 entries
Core - Fixed administrators being unable to reset a contractor's password
Core - Fixed an issue where moving entries between vaults failed and could break linked credentials
Core - Fixed an issue where moving entries to another vault no longer worked
Core - Fixed an issue where the "Force MFA" setting could remain enabled after migrating from SQL to DVLS with no way to disable it
Core - Fixed an issue where the server could remain permanently in maintenance mode after an interrupted maintenance run
Core - Fixed automatic database retention cleanup not running when using a non-English SQL login
Core - Fixed contractors being able to change or remove their own 2FA configuration without re-entering their password
Core - Fixed database upgrades timing out during long-running steps, particularly on Azure SQL
Core - Fixed notification preference emails containing a mix of translated and English text
Core - Fixed partially translated email notifications and improved their date formatting
Core - Fixed renamed folders and their contents disappearing from the connection tree
Core - Fixed scheduled database retention incorrectly archiving or purging records within the configured retention period
Core - Fixed support ticket submissions reporting success without creating a support case
Core - Fixed the offline synchronization document size limit exceeding the value supported by Remote Desktop Manager
Core - Fixed the scheduler service crashing when a custom log retention policy contained invalid values
Core - Fixed the User column appearing blank in Global Open Sessions when Remote Desktop Manager was connected to a Devolutions Server data source
Core - Fixed ticket prompts accepting free-form text when an existing ticket was required
Core - Fixed user vault entry errors after migrating a SQL data source to DVLS
Core - Fixed vault and folder password complexity policies being displayed as inherited without being enforced
Core - Harmonized checkout and check-in behavior across platforms
Gateway - Fixed an error when trusting a Devolutions Gateway certificate on Kestrel-hosted instances
Gateway - Fixed incorrect gateway host and port resolution for native iLO and SQL Server sessions
Gateway - Fixed session recording failures for Active Directory Console entries using a Devolutions Gateway farm
Gateway - Fixed session recordings being larger than expected because configured frame rate and resolution settings were ignored
PAM - Fixed accounts incorrectly appearing as Out of sync in Remote Desktop Manager
PAM - Fixed Active Directory discovery, OU browsing, and group lookups failing with trusted domain controller certificates
PAM - Fixed Active Directory TLS certificate validation and trusted certificate issues affecting discovery, OU browsing, and group retrieval
PAM - Fixed an error when filtering containers during account discovery
PAM - Fixed an issue where Active Directory account discovery returned no accounts for child domains when the forest root was unreachable
PAM - Fixed an issue where moving a PAM entry to a folder in another vault failed
PAM - Fixed checkouts not expiring and scheduled password rotations not running when many accounts were checked out simultaneously
PAM - Fixed Cisco and MySQL password reset providers being uneditable after creation and restored the Cisco username field
PAM - Fixed PAM account lifecycle and checkout policies being creatable without a valid PAM license
PAM - Fixed PAM accounts incorrectly appearing as "Out of sync" in Remote Desktop Manager
PAM - Fixed the "Automatically check in PAM account" setting displaying the wrong value
PAM - Fixed the total checkout time being displayed incorrectly when an account was automatically checked in
PAM - Fixed the View and Copy one-time password actions being unavailable in Remote Desktop Manager for checked-out PAM accounts with OTP configured
PAM - Fixed users with a PAM provider role losing access to the Privileged Access section
Web - Fixed closing a session from the kebab menu redirecting to Administration > Vaults instead of the current vault, and corrected the disconnect message
Web - Fixed entries disappearing from the Connections tree when moved by drag and drop while a filter was active
Web - Fixed long entry names being truncated in the Sessions tree and hiding the session recording indicator
Web - Fixed Telnet sessions terminating unexpectedly
Web - Fixed terminal sessions leaving network connections open after being ended from the server side
Web - Fixed the "Find by name (user vault)" dialog displaying irrelevant results when no entry matched
Web - Fixed the Connections tree not refreshing after deleting an entry while a filter was active
Web - Fixed the Credentials dropdown offering "Linked (cross vault)" for user vault entries when the option was disabled
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version
Security
10
Core - Fixed a security issue where the legacy partial login endpoint accepted and retained client-supplied session identifiers after authentication
Core - Fixed a SQL injection vulnerability in the database backup path setting
Core - Fixed an issue where low-privileged users could restore and permanently delete vault attachments through attachment history
Core - Fixed authentication and session tokens being stored unencrypted in the database
Core - Fixed integration secrets in data source settings being visible to users without administrative permissions
Core - Fixed missing access controls that allowed users without the required permissions to read or save System Vault entries
Core - Fixed the Microsoft Entra ID application secret being exposed in URL query strings when retrieving groups and role templates
Gateway - Fixed a security issue where any authenticated user could obtain a network scan token and access internal network information
PAM - Fixed domain controller detection occurring before the Devolutions Gateway ruleset was enforced, allowing network traffic to bypass the ruleset and gateway logging
PAM - Fixed the legacy WinRM client mode ignoring the "Skip TLS certificate validation" setting and always skipping certificate validation for HTTPS hosts
Fixes
3
Core - Fixed the "dvls-admin" user on Basic installations being able to bypass the required password change by closing the browser
Core - Fixed users without System Vault entry edit permission being able to edit System Vault entries through their regular entry permissions
Web - Fixed trailing spaces being saved in tags and "Exact expression" notification subscription filters despite appearing to be removed in the interface
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version
Security
1
DVLS-14910 Core - Fixed the vault entry listing returning passwords and sensitive information to users who only had permission to view entry names, bypassing the "View password" permission
Improvements
3
DVLS-12432 Core - Added the missing variables to the Variable Manager so it matches the set available in Remote Desktop Manager
DVLS-14627 Core - Improved the performance of moving entries to another vault, preventing SQL timeouts in vaults holding several thousand entries
DVLS-14686 Core - Improved Emergency Login by trimming leading and trailing spaces from the username, so a copied and pasted username no longer fails to sign in
Fixes
8
DVLS-13550 Core - Fixed the scheduler service crashing when a custom log retention policy was saved with invalid values
DVLS-13774 Core - Fixed the forced data source MFA setting being incorrectly carried over after a SQL to Devolutions Server migration, which left users locked out with no way to disable it
DVLS-14452 Core - Fixed valid licenses disappearing after an update when an expired license was present in the list
DVLS-15036 Web - Fixed live session shadowing gradually falling behind the source session during sustained screen activity
DVLS-15085 Core - Fixed the User column being blank in the Global Open Sessions view when Remote Desktop Manager is connected to a Devolutions Server data source
DVLS-15118 PAM - Fixed the Windows User provider always using the in-house WinRM client for discovery and heartbeat, with no way to switch back to the legacy Windows WSMan client
DVLS-15148 Core - Fixed automatic database retention cleanup silently doing nothing on servers whose SQL login language is not English, leaving tables to grow indefinitely with the error visible only in the Windows event log
DVLS-15166 Core - Fixed scheduled database retention archiving or purging every row in a table regardless of the configured age, while "Clean up now" behaved correctly
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version
Fixes
7
Core - Fixed an invalid license error when connecting from Remote Desktop Manager or the Launcher to servers using PAM package licenses with auto-assign enabled
Core - Fixed an issue where System Settings couldn't be saved from Remote Desktop Manager when a ticketing system was configured
Core - Fixed an issue where User Vault credentials couldn't be set in user-specific settings when entry creation was restricted to templates only
PAM - Fixed an issue where the Get-DSPamVault PowerShell cmdlet returned errors or no results when listing accessible PAM vaults
Web - Fixed an issue where spaces couldn't be entered when renaming an entry or folder from the right-click menu
Web - Fixed an issue where the "User vault" label wasn't displayed in the configured language until the page was refreshed
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version
Improvements
3
PAM - Improved the Grant temporary access screen by fixing scrolling when browsing the list
PAM - Reduced Active Directory lookups when resolving approvers, improving responsiveness during approval actions
Web - Added support for X.509 certificate credentials, allowing certificate entries created in Remote Desktop Manager to be viewed and used in the web interface
Fixes
10
Core - CVE-2026-14536 Fixed an issue where MFA policies were not enforced when no default MFA method was configured
Core - Fixed an intermittent login loop affecting YubiKey and MFA users
Core - Fixed an issue where users using Alternate Email MFA were no longer recognized as having MFA enabled after updating
Core - Fixed duplicated telemetry events and improved cleanup of outdated events
Core - Multiple UI fixes
PAM - Fixed a missing Checkout permission message when approving a checkout without the required permission
PAM - Fixed an issue where users without the required vault access could appear as approvers
Web - Fixed a loading overlay that blocked interaction with the compromised password dialog
Web - Fixed an issue preventing Equivalent URLs from being configured on Web Browser entries
Web - Fixed the Copy to clipboard action in the password list
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version
Security
5
Core - Fixed a security issue where ticketing service credentials (ServiceNow and Jira) could be viewed by authenticated users through data source settings
CVE-2026-11890 PAM - Fixed missing permission checks on discovery scan results, ensuring only authorized users can access discovery data
CVE-2026-12105 Core - Fixed a security issue where duplicating a folder could expose attachments and handbook pages to users without access to the original content
CVE-2026-12105 Core - Fixed an issue where social-login entry metadata could be visible to vault members who were explicitly denied access to those entries
Core - Fixed a privilege escalation issue that could allow users creating vaults or PAM providers to assign themselves System Administrator rights
Improvements
4
Core - Website Legacy entries can no longer be edited and must be converted before use. The option to permanently dismiss the conversion notice has also been removed
PAM - Added requested elevation details to reports
PAM - Added visibility into which approvers received temporary access and PAM checkout requests
PAM - Prevented users from approving their own checkout requests through linked accounts when self-approval is disabled
Fixes
16
Core - Fixed a performance regression that caused system permission changes to take longer than expected to save
Core - Fixed a synchronizer error that occurred when nested groups were deleted in Entra ID (Azure AD)
Core - Fixed an issue preventing orders from being created when they contained both a starter pack and additional licenses
Core - Fixed an issue where changing a password on first login after a basic installation could fail
Core - Fixed an issue where exported attachments and documents could become unusable after re-importing with attachments included
Core - Fixed an issue where the "Template list only" mode was not enforced, allowing entries to be created without a template
Core - Fixed an issue where variables were not resolved when unsealing entries or sending related notifications
Core - Fixed false password-change audit logs and notification emails when updating non-credential Website entry settings
Core - Improved loading performance for repository assignments, including the Batch Grant Access window
PAM - Fixed PostgreSQL accounts incorrectly appearing out of sync after successful password resets
PAM - Fixed the "MFA on checkout" default setting not being saved
Web - Fixed a JavaScript error when viewing entry details containing deserialization errors under Reports > Diagnostic > Entries
Web - Fixed an issue where deleting an entry could trigger an error and leave the connections tree in an incorrect state until the page was refreshed
Web - Fixed an issue where unsupported AI Assistant providers appeared blank in the edit dialog and could cause the wrong provider to be saved
Web - Fixed Synchronizer entries becoming unusable in the web interface when the synchronization mode was set to manual or inherited manual
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.2 is required for this DVLS version
New features
9
Core - Added a certificate-based Conditional Access Policy for certificate authentication
Core - Added a dedicated AI Assistant entry in DVLS
Core - Added a new credential mode to save and autofill social logins with the Password Manager extension
Core - Added in-app notifications when a new DVLS server version is available
Core - Added support for Microsoft Entra ID authentication using delegated permissions
Core - Added the ability to configure the number of simultaneous checkouts allowed for an entry
PAM - Added the ability to configure a default elevation group during checkout
PAM - Added the option to require MFA when checking out a PAM account
Web - Added Brandfetch auto-complete support when creating website entries
Improvements
15
Core - Added a search bar in the user selection dialog when creating a new domain user, searchable by sAMAccountName, displayName and OU
Core - Added CVE vulnerability checks on the security dashboard with upgrade recommendations
Core - Added the ability to filter entries by connection type through the REST API
Core - Email notifications now use the user's configured language preference
Core - Improved contractor user management with a redesigned onboarding experience, automatic password generation, and clearer disabled user indicators
Core - Reduced the in-app trial period from 30 days to 14 days
PAM - Added a "Skip TLS validation" option for the Windows provider
PAM - Added support for using the provider account for SSH password heartbeat when target accounts have SSH access disabled
PAM - Enhanced password rotation scheduling with more flexible configuration options
PAM - Improved access requests to include the full hierarchy of linked connections
Web - Added a button to clear all user notifications
Web - Added a Convert button to the legacy website banner for faster entry conversion
Web - Added a notification in the Administration Dashboard when a new DVLS version is available
Web - Added vertical navigation in the Administration and Reports areas to make settings easier to find
Web - Extended user synchronizer support in the web interface
Fixes
42
Core - Fixed a missing translation when requesting access to available vaults
Core - Fixed a NullReferenceException that could occur when a deleted connection notification was processed
Core - Fixed a portable license error ("Invalid license: RDM") on first login
Core - Fixed a regression where Custom permissions behaved as Denied in web and RDM clients
Core - Fixed a regression where vault assignments were not applied during user group import
Core - Fixed a SQL timeout when renaming folders containing a large number of entries
Core - Fixed an Access Denied error when non-admin users tried to add an entry from a template
Core - Fixed an error when opening Duo MFA settings and improved invalid credential validation
Core - Fixed an error when starting a trial with an no email address
Core - Fixed an issue where duplicating a folder did not copy sub-entries
Core - Fixed an issue where entry types disappeared from Type Availability when the last selected vault was content-restricted
Core - Fixed an issue where removing an expired license incorrectly prompted for DVLS Free
Core - Fixed attachments being lost when moving entries to another vault
Core - Fixed DVLS being unable to connect to SQL Server on Linux when TLS encryption was enabled
Core - Fixed Entra App Proxy pre-authentication failing when the DVLS account had MFA enforced
Core - Fixed linked external vault information not being saved when linking an SSH key
Core - Fixed missing translation and username details in temporary access approval emails
Core - Fixed Syslog over TCP messages not being RFC 6587 compliant, preventing ingestion by some collectors
Core - Fixed the "Do not show again" option not working in the Clipboard Privacy warning dialog
Core - Fixed trailing spaces being saved in Tags and in Notification Subscription "Exact expression" parameters
Core - Fixed User Settings Vault and Global settings not working for non-admin users in RDM
Gateway - Fixed an issue where "Ping all Gateways" incorrectly reported failures
Gateway - Fixed an issue where Gateway vault security incorrectly applied to PAM providers
Gateway - Fixed GatewayManager creating a short-lived, undisposed HTTP client for every request, which could lead to socket exhaustion
Gateway - Fixed the Update button remaining disabled after deleting a configured Gateway
PAM - Fixed a regression where inherited OTP no longer worked on PAM accounts
PAM - Fixed an issue where admins appeared as approvers even when disabled in settings
PAM - Fixed an issue where approval through role/group permissions did not work
PAM - Fixed checkout approvers not appearing in the approvers list when no PAM license is assigned
PAM - Fixed having to scroll to access buttons in Reports > PAM Check-out requests
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS version
Security
3
Core - Fixed a security issue where duplicating a folder could expose attachments and handbook pages to users without access to the original content
Core - Fixed a security issue where ticketing service credentials (ServiceNow and Jira) could be viewed by authenticated users through data source settings
PAM - Fixed missing permission checks on discovery scan results, ensuring only authorized users can access discovery data
Fixes
4
Core - Fixed an issue where the "Template list only" mode was not enforced, allowing entries to be created without a template
Core - Fixed login failures when using MaxMind GeoLite2 with location-based access policies
Web - Fixed an issue where deleting an entry could trigger an error and leave the connections tree in an incorrect state until the page was refreshed
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS version
Security
15
CVE-2026-5171 Core - Fixed an issue where users without Activity Logs permission could still retrieve entry logs through the API
CVE-2026-7325 PAM - Fixed an LDAP coercion issue that could force DVLS to authenticate against a malicious LDAP server
CVE-2026-8477 Core - Fixed a security issue where sealed entries could be accessed through the partial sensitive-data endpoint without triggering unseal notifications
CVE-2026-9047 Core - Fixed an issue where adding an additional MFA factor could remove an existing MFA key
CVE-2026-9223 Core - Fixed a missing permission check that could allow users to create a new vault when importing an .rdx file referencing a non-existent vault
CVE-2026-9224 Core - Fixed an issue where Active Directory accounts could modify their own profile data through the API despite UI restrictions
CVE-2026-9245 Core - Fixed an open redirect vulnerability during external OAuth sign-in failures or cancellations
CVE-2026-9246 Core - Fixed an issue where handbook content and attachment metadata from sealed entries could be accessed without following the unseal workflow
CVE-2026-9247 Core - Fixed an issue where sealed credentials could be unsealed in another DVLS instance without notifying administrators, and improved handling of linked sealed credentials after import
CVE-2026-9248 Core - Fixed an issue where duplicating a connection could copy handbooks and attachments from entries the user could not access
CVE-2026-9249 Core - Fixed a password change bypass that allowed users to change passwords without providing the previous password
CVE-2026-9251 Core - Fixed an issue where non-admin users could bypass the Pending Approval flow by changing an entry's status
Core - Added audit logging for Send Copy actions so administrators can track who shared entries and with whom
Core - Hardened the authorization cache key to prevent any future cache-poisoning regression (follow-up to CVE-2026-1768)
Core - Improved authentication security to prevent external-provider sessions from bypassing password authentication under a different login method
Improvements
3
Core - Improved Active Directory user creation performance
PAM - Added an option to skip TLS validation for the Windows Provider
Web - Added Command key support for multi-selection in the web interface, allowing Mac users to extend selections with Cmd-click
Fixes
5
Core - Fixed a NullReferenceException in the notification processing service that could leave notifications stuck in an unprocessed state
Core - Fixed an issue where Linked (External) credentials were not saved correctly on SSH entries linked to an SSH Key
Core - Fixed attachments being lost when moving an entry to another vault
Core - Fixed folder duplication so sub-entries are duplicated along with the parent folder
Web - Fixed a TypeError when opening the Advanced Search dialog as a user without a User Vault
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2026.1 is required for this DVLS versionThis version requires the .NET 10 Hosting Bundle
Security
2
CVE-2026-3204 Core - Fixed an issue where the error message page displayed a tamperable error message
CVE-2026-4434 Fix Improper certificate validation in WinRM connections
New features
16
Core - Added custom vault dashboard widgets with drag-and-drop reordering
Core - Added Just-in-Time (JiT) access for SSH (sudo) sessions
Core - Added new Contractors account type with expiration date support
Core - Added support for SSH key certificates in the web
Core - Added vault priority sorting
Core - Admins can create preset dashboards for users
Core - Licenses can now be purchased directly within DVLS
Core - Multiple improvement and fixes with the synchronizer where they was mismatch with RDM
Core - Users can now request a trial directly from the application
Core - Users can now request sudo access when requesting checkout
Gateway - Added RDP credential injection for more secure session launches
Gateway - Added traffic event logs to privileged session monitoring
PAM - Added MongoDB provider support
PAM - Added PowerShell session recording
PAM - Added the ability to automatically terminate active sessions when a PAM account is checked in
PAM - Added UI to assign and manage risk levels for roles
Improvements
37
Core - Added "Prompt on connection" support for linked VPN/SSH/Gateway sessions, matching the behavior already available for linked credentials
Core - Added launch links on connections for quick session sharing
Core - Added missing fields in the "Advanced" tab for SFTP connections
Core - Added OTP support for linked external vaults
Core - Added support for editing Delinea Secret Server entries directly within DVLS
Core - Admins can set the default behavior for automatically checking in PAM accounts when closing entries
Core - Deprecated read-only and restricted permission types
Core - Entra ID now enforces secret expiration with banner and email warnings
Core - Entry security settings now use inherited values by default
Core - Error reports now include connection type details
Core - Improve Entry Security Analyzer report to include all relevant fields, matching the information already available in RDM
Core - Improved license management — disabling a user now automatically removes their assigned licenses
Core - Improved performance for access requests in RDM
Core - Linked vaults can now point to entries in the same folder
Core - Public API now supports CRUD operations for folders and vaults
Core - Renamed Log Retention Policies to Database Retention Policies and added retention options for connection history, remote sessions, and traffic events
Core - Simplified license assignment in data sources
Core - Synchronizers now support scheduling by hour
Core - Tags can now be used with inheritance rules
Core - The public API now supports full CRUD operations for vaults, allowing administrators to create, read, update, and delete vaults programmatically
Core - Users can now configure multiple MFA methods at once
Gateway - Renamed "Virtual Gateway" to "Gateway ruleset"
Gateway - Sessions can now be recorded on a different gateway than the launch gateway
Gateway - The Gateway Diagnostic window now displays whether Devolutions Agent is installed and running
Gateway - The gateway list now automatically refreshes after an update request completes
PAM - Added "Create folder" option when importing PAM accounts
PAM - Added "Workspace" as a supported application option in the PAM usage policies admin section
PAM - Improved error message when no provider is specified on a PAM account
PAM - Renamed "Scan" to "Account Discovery"
PAM - Users without a PAM license can now perform basic PAM operations, such as checking out PAM credentials, without requiring a full PAM license Assignment
Web - Added a warning in the web interface when an OTP account name contains a colon (":"), consistent with existing behavior in RDM
Web - Administrators can now set permissions on entry types that are not technically supported on the web
Web - Users can now customize the "Add connection" favorites section
Web Client - Multiple UI improvements
Web Client - Updated dark theme
Fixes
27
Core - Fixed a regression where it was no longer possible to set a user as an administrator
Core - Fixed a scheduler timeout error that could cause scheduled tasks to fail intermittently
Core - Fixed an error occurring when too many vaults were present
Core - Fixed an error that occurred when editing account login information on a deprecated entry type
Core - Fixed an issue where exported logs from the DVLS Console were being cropped and truncated
Core - Fixed an issue where forbidden passwords could still be saved in a password list entry
Core - Fixed an issue where new Active Directory user accounts were not appearing in DVLS, preventing the auto-create on first login feature from Working correctly
Core - Fixed an issue where OAuth token rejections were incorrectly returning HTTP 200 with an empty response instead of a proper error code
Core - Fixed duplicate vault cards appearing on the dashboard
Core - Fixed notification emails being sent in English for users configured in French
Core - Fixed repeated migration attempts after SQL migration and server restart
Gateway - Fixed a issue where clicking "Close" from the session kebab menu did not always close the session on the first attempt
Gateway - Fixed a missing configuration option in the Web UI for allowing additional hosts through Devolutions Gateway
Gateway - Fixed an inconsistency in how Gateway tunnels were configured and displayed between RDM and the Web UI
Gateway - Fixed an issue where enabling vault-level security on a gateway prevented it from being used in gateway farms and PAM providers
Gateway - Fixed an issue where virtual gateways were not automatically deleted when their associated physical gateway was removed, leaving orphaned entries that no longer functioned
PAM - Fixed "Nobody" account appearing when "Ignore system users" was enabled
PAM - Fixed a security issue where non-administrator users could view other users' PAM actions in the Privileged Access logs
PAM - Fixed account discovery failure caused by circular security group membership
PAM - Fixed an error that occurred when attempting to add a folder to a newly created PAM vault during the import process
PAM - Fixed an issue where Domain Quick Scan was no longer working
PAM - Fixed an issue where groups located in the Builtin organizational unit were not visible when selecting groups for JIT (Just-In-Time) elevation
PAM - Fixed Local Windows scan failure when credentials were linked
PAM - Fixed SSH scan failure when sudo was configured with NOPASSWORD
Web - Fixed inconsistent rendering of secure notes set as Markdown across different platforms
Web - Fixed the Notification Subscriptions filter not working correctly
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2025.3 is required for this DVLS version
Security
2
[CVE-2026-10615]Core - Fixed synchronizers running against sealed credentials without prompting for unsealing first
CVE-2026-9223 Core - Fixed a missing permission check that could allow users to create a new vault when importing an .rdx file referencing a non-existent vault
Fixes
2
Core - Fixed sign-in issues when using Entra App Proxy with MFA and pre-authentication enabled
Core - Restored compatibility between single sign-on (SSO) and multi-factor authentication (MFA)
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2025.3 is required for this DVLS version
Security
13
CVE-2026-5171 Core - Fixed an issue where users without Activity Logs permission could still retrieve entry logs through the API
CVE-2026-7325 PAM - Fixed an LDAP coercion issue that could force DVLS to authenticate against a malicious LDAP server
CVE-2026-8477 Core - Fixed a security issue where sealed entries could be accessed through the partial sensitive-data endpoint without triggering unseal notifications
CVE-2026-9224 Core - Fixed an issue where Active Directory accounts could modify their own profile data through the API despite UI restrictions
CVE-2026-9245 Core - Fixed an open redirect vulnerability during external OAuth sign-in failures or cancellations
CVE-2026-9246 Core - Fixed an issue where handbook content and attachment metadata from sealed entries could be accessed without following the unseal workflow
CVE-2026-9247 Core - Fixed an issue where sealed credentials could be unsealed in another DVLS instance without notifying administrators, and improved handling of linked sealed credentials after import
CVE-2026-9248 Core - Fixed an issue where duplicating a connection could copy handbooks and attachments from entries the user could not access
CVE-2026-9249 Core - Fixed a password change bypass that allowed users to change passwords without providing the previous password
CVE-2026-9251 Core - Fixed an issue where non-admin users could bypass the Pending Approval flow by changing an entry's status
Core - Added audit logging for Send Copy actions so administrators can track who shared entries and with whom
Core - Hardened the authorization cache key to prevent any future cache-poisoning regression (follow-up to CVE-2026-1768)
Core - Improved authentication security to prevent external-provider sessions from bypassing password authentication under a different login method
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2025.3 is required for this DVLS version
Security
4
CVE-2025-13757 Core - Core - Fixed SQL injection vulnerability in the last usage logs API endpoint Privileged Sessions Monitoring
CVE-2025-13757 Core - Fixed SQL injection vulnerability in the last usage logs API endpoint
CVE-2025-13758 Core - Fixed security issue where sensitive credentials were exposed in API responses for certain connection types (SMB, HyperV, WebDav, and others)
CVE-2025-13765 Core - Fixed security issue where SMTP configuration with passwords could be viewed through the API without administrator permissions
Improvements
5
Core - Added requirement for Entra ID secret expiration date during configuration to prevent unexpected login failures
Core - Improved Entra ID authentication by displaying warning banners and sending email alerts to administrators when secrets approach expiration
PAM - Added ability to create folders directly during PAM account import process
PAM - Improved PAM administrator access to automatically grant access to all PAM vaults without manual assignment
PAM - Reduced notification frequency for PAM health checks by sending alerts only once when accounts become out of sync
Fixes
7
Core - Fixed database permission errors for scheduler service on notification group subscriber tables
Core - Fixed database permission errors for scheduler service when inserting telemetry events
Core - Fixed duplicate key violations that occurred during server startup when users had both administrator and vault owner roles
Core - Fixed erroneous mismatch log messages during SSO authentication from RDM
Core - Fixed issue where configured additional access URIs were no longer accessible
Core - Fixed login failures and server crashes when new users attempted to authenticate
Web - Fixed issue where PAM account approval requests in the messages UI would freeze the interface and require page refresh
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2025.3 is required for this DVLS version
Security
1
CVE-2025-11958 Core - Fixed a security vulnerability that could cause the Security Dashboard to become unavailable
New features
14
Core - Added a "Linked (External Vault)" option for entries, allowing sessions to reference credentials stored in an external vault
Core - Added an onboarding experience for new installations to simplify initial setup
Core - Added an option to enable biometric lock for the Workspace app
Core - Added support for a custom, editable dictionary for passphrase generation
Core - Added the ability for users to create an API key for their account
Core - Added webhook support for specific trigger events
Core - Require re-authentication before allowing users to change MFA
Core - Users can now configure their own MFA
Gateway - Added a new setting to enable RDP reconnection
Gateway - Added network access rules for virtual gateways, with scoping by IP address, IP range, subnet, and DNS name
Gateway - Added virtual gateways, enabling different permissions on the same physical gateway
PAM - Added "Account Life Policies," consolidating PAM options and enabling inheritance at all levels (entry, folder, root)
PAM - Added conditional policies based on JIT elevation status
Web - Added support to disconnect WBEX sessions on close and when idle
Improvements
14
Core - Changed default of password policy and password validation to be handled as "Inherited" - Make sure your inheritance structure is appropriate
Core - Added password expiration to password policies
Core - Added support for attachments when sending via Devo Send in DVLS
Core - Editing an entry now triggers the checkout option
Core - Improved image management with the ability to merge duplicate images
Core - Improved LDAP domain controller fallback for faster failover
Core - Improved the Entry Properties menu to align with RDM, making options easier to find
Core - Removed the ability to grant permissions on entries in vaults the user cannot access
Core - Renamed "Cleanup Log" to "Log Retention Policies"
Core - Renamed "Password Templates" to "Password Policies"
Core - Temporary access on a folder now extends to entries created in that folder after the request
PAM - Added support for editing accounts directly in RDM
PAM - Added tier detection during account discovery for domain and Entra ID accounts
PAM - Local Account scan results now exclude provider service accounts
Fixes
10
Core - Fixed an issue where renaming a folder with a backslash () would break the folder
Core - Fixed an issue where the password generator would not open when editing an entry
Core - Reduced the number of emails sent when Syslog is down
PAM - Fixed an error that occurred when adding JIT elevation to a PAM checkout
PAM - Fixed an error when importing computers from an AD scan
PAM - Fixed an issue where editing Account Life Policies could result in an infinite loading state
Web - Fixed an issue where SSH sessions returned "The authentication sequence has failed" when launched in the web client with a linked-to-vault private key
Web - Fixed an issue where web sessions could not be opened with a PAM credential
Web - Restored the top menu button when opening ARD web sessions
Web - Various user interface fixes and improvements
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2025.2 is required for this DVLS version
Security
2
CVE-2025-13757 Core - Fixed SQL injection vulnerability in the last usage logs API endpoint
CVE-2025-13758 Core - Fixed security issue where sensitive credentials were exposed in API responses for certain connection types (SMB, HyperV, WebDav, and others)
Fixes
1
Core - Fixed erroneous mismatch log messages during SSO authentication from RDM
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2025.1 is required for this DVLS version
Security
3
CVE-2025-4433 Core - Fixed an issue where a user with the User Management permission could promote users to admins via user groups
CVE-2025-4493 PAM - Fixed an issue where "Assigned provider privileges" in JIT privileged sets would select all available groups when adding a new provider privilege
CVE-2025-5382 Core - Fixed an issue where a user with the User Management permission could remove MFA from an admin user
Improvements
1
PAM - Allowed use of the backslash character (‘') in Windows account names
Fixes
4
Core - Fixed an issue where sessions in the web client would not work when "Prompt on connection" was enabled
Core - Fixed an issue where the "Invalid License" error incorrectly appeared when editing a user
Core - Fixed an issue where users could lose all repository access, causing a red "X" to appear on vault selection in RDM
PAM - Prevented multiple emails from being sent when an account fails to reset its password on schedule
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2024.3 is required for this DVLS version
Security
2
CVE-2025-4316 PAM - Fixed an issue where an admin could approve their own checkout even if approval was required
PAM - Fixed an issue where "Assigned provider privileges" in JIT privileged sets would select all available groups when adding a new provider privilege
RequiresIf you are using a client (RDM, PowerShell, etc.), version 2024.3 is required for this DVLS version
Security
1
CVE-2025-2003 PAM - Fixed an issue where the "Add in Root" permission was not respected in PAM vaults
Breaking
1
Core - We've updated our integration with your Entra ID environment to align with Microsoft Entra's latest security policies. As part of this update, client secrets with an expiration period longer than two years are now deprecated. Please review and update your current configuration by following the instructions in the following link: https://docs.devolutions.net/server/kb/how-to-articles/azure-portal-configuration-guide-microsoft-authentication
Fixes
2
Core - Fixed an error that could occur when exporting login history
Core - Fixed an issue where the folder structure could disappear when adding or editing entries/folders in RDM
RequiresDatabase upgrade requiredRDM and Devolutions Server Console 2022.2 are required to use this version
Breaking
3
Core - .NET 6.0 is now required
Gateway - Devolutions Gateway now requires a license (unlicensed usage will be refused except for side-by-side installation that can have up to 5 concurrent sessions without a license)
Core - Website entry (previously "Web Browser (HTTP/HTTPS)") now has Workspace browser extension enabled by default
New features
10
Core - Emergency access to allow an access even if providers are down (Azure or AD)
Core - New permission : "Delete Documentation"
Core - New permission : "View Sensitive"
Core - Notifications : Users can be notified on actions made on entries
Core - Security policies available to allow/deny users with different conditions
Core - Security policies available to force/skip 2FA with different conditions
Gateway - Support for new protocols : VNC, ARD, SCP, SFTP, PowerShell (WinRM, SSH), Embedded Websites
PAM - Add link with ticketing system (JIRA) to list tickets during the checkout operation
PAM - Support for password reset for MySQL users, Oracle users and Cisco users
PAM - Support for standalone privileged accounts
Improvements
14
Core - Added "append to the username" and "prepend to the username" modes for OTP usage
Core - Added a button to test ticketing system configuration
Core - Added more fields in asset dashboard (UPN, custom fields)
Core - Added a new license for the PAM Module (the license is included for those already using the PAM module with a DVLS license bought before September 30th 2021)
PAM - Added local Windows account management
Web - Added an option to regenerate Devolutions Gateway key pair on demand
Web - Added batch edit to grant permissions all at once on an entry
Fixes
5
Core - Fixed an issue where a user can delete entries without permission
Core - Fixed the display of shortcut entries
Core - Stack overflow error when migrating the domain user groups with their SID
PAM - Fixed an issue where approval workflow didn't work when approved by an "approver"
Core - The user vault has now the same features as a standard vault (i.e.: attachments, history, documentation)
Introduced a distinction between sensitive properties and passwords in Information Entries. The view password permissions now only affect passwords specifically
New features
10
Core - Added support for Devolutions Gateway (Jet)
Core - Added the "Last login" report
Core - Added the entry type: azure service principal
Core - Added the field Tenant ID on API Key
PAM - Added a system of policies on team folders for easier management
PAM - Added the delta between results when scanning a domain
Web - Added support for default icon color
Web - Added the option when enter a licence or request a trial when the license is expired or when there is no license
Web - The interface is available in read-only when the license is expired or when there is no license
Web - The scheduled reports now support more reports
Improvements
27
Core - Added a timeout setting to Radius configuration
Core - Added Devolutions Authentificator as a supported 2FA
Core - Added handling of the custom controls on web entries for DWL
Core - Added the authentication method on the login history report
Core - Added the expression "is not" when setting a filter on a subscription
Core - SqlException when starting a connection from a templage
Core - Syslog events, only sends the title of the stack trace
Core - Updated the library for sending emails
Web - Added a download button on document's dashboard
Web - Added a message when the license is expired
Web - Added custom fields on web entries
Web - Added multiple gateways on SCP and SFTP entries
Web - Added multiple gateways on SSH Shel, SSH Tunnel and SSH Port Forward entries
Web - Added Recents, on the new entry dialog
Web - Added recovery codes for OTPs
Web - Added the "Disconnect Data Source" option in the administration section
Web - Added the OPT on Web entries
Web - Added the option to set the "Allow Offline" to a vault
Web - Added the options to view and download the Private key
Web - changed UI
Web - Manage the password setting "Force Default Template"
Web - Remove the email being mandatory when creating a user
Web - secure message, Added the options to "Delete All" and "Mark all as read"
Web - Update the default date range to "today" instead of "Last 7 days" on the activity log report
Web - Updated Radius login labels
Web - Updated the icons
Web - Updated the scrolling when navigating to an entry from the search
Fixes
43
Core - Access was denied on api call for the documentaion
Core - Error SecurityTokenExpiredException received several time a day
Core - Error when adding an email to a user that didn't already had one
Core - Error when enabling the Windows Event Log
Core - Error when importing in the Private Vault
Core - Error with RDM on limited mode
Core - Fix access denied error on documentation
Core - Fix CORS
Core - Fix templates showing in the activity logs
Core - MaxMind GeoIP block everything
Core - Sql Injection
Core - Updated date format on reports
Core - Updated the default STMP Port
Core - Updated the SQL Queries when doing cleanup tasks to avoid timeouts
Core - Wrong log in "Connected User" report when connected from the Launcher
RDM - Cannot download Session recording form Recording Server in RDM
Web - "Prompt for comment" memo is overflow window is not tall enough
Web - Bad email format result in JSON error when editing a user
Web - Checkout UI issue on Firefox
Web - Error when trying to upload an SSH key
Web - Fix cannot assign users and user groups when creation a vault
Web - Fix error on reports when no vault is selected
Web - Fix loading the domain user speed issue
Web - Fix secure message color in dark mode
Web - Fix should not be able to set status on an entry when a check out is required
Web - Fix the vault menu item being available when there are no vault
Web - Fix variable not resolved on connections
Web - Fix variable not resolved on sub-connections
Web - Infinite loading when Azure token expires
Web - Missing icons on the web interface
Web - notification subscriber edit window is not tall enough
Web - On the Login History reports is not showing all entries
Web - RDP Template doesn't save "local ressources"
Web - Tab title is not updated
Web - The licence count is not updated when managing licenses
Web - The password reset is not applied when switching users
Web - The recurrence is not shown properly on the scheduled report calendar
Web - The website does not load properly when the the database is not reachable
Web - UI issue in Vault on Firefox
Web - UI issue when adding a user
Web - Unable to create a Contact Company entry in a folder
Web - User loses its license when changing the user type
