These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A vulnerability was found in Devolutions Server, which allows an attacker to change a user's password without providing the previous one via a crafted password change request. This issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The vulnerability has a CVSS score of 3.1 and is classified as LOW severity. Administrators and users of affected versions sh [truncated]
CVE-2026-9248 is an authorization bypass vulnerability in the entry duplication feature of Devolutions Server. An authenticated user with write access to any vault can copy documentation and attachments from an entry in a vault they cannot access via a crafted save request. This issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The vulnerability has a CV [truncated]
CVE-2026-9247 is a low-severity vulnerability in Devolutions Server, a software solution for managing and securing privileged accounts. The issue lies in the entry export feature, where an authenticated user with export permissions can export a sealed entry without triggering the unseal notification to administrators via a crafted export request. This vulnerability affects Devolutions Server versions 2026 [truncated]
CVE-2026-9246 is an improper access control vulnerability in Devolutions Server's entry documentation and attachment features. An authenticated user with vault read access can retrieve documentation and attachments of sealed entries via a crafted API request. This issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The vulnerability has a CVSS score of 4.3 [truncated]
CVE-2026-9245 is a medium-severity vulnerability in Devolutions Server, allowing unauthenticated remote attackers to redirect victims to an attacker-controlled domain via a crafted login link due to improper input validation in the external authentication provider flow. This issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. Users should be aware of this [truncated]
CVE-2026-9224 is a medium-severity vulnerability in Devolutions Server, allowing an authenticated Active Directory user to modify their own profile attributes via a crafted API request due to missing authorization in the user profile update feature. This issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The vulnerability has a CVSS score of 4.3 and a sev [truncated]
A vulnerability exists in Devolutions Server 2026.1.16.0 and earlier, where a low-privileged authenticated user can create new vaults via a crafted import request due to missing authorization in the vault import feature. This issue allows unauthorized vault creation, potentially leading to security risks. Users of Devolutions Server 2026.1.16.0 and earlier should apply the vendor's remediation to prevent [truncated]
CVE-2026-9047 is a HIGH severity vulnerability in Devolutions Server, with a CVSS score of 7.6. The vulnerability is caused by improper handling of factor key state in the multi-factor authentication management feature. This allows an attacker with knowledge of a user's password to bypass the user's multi-factor authentication after the user reconfigures their factors. The vulnerability affects Devolution [truncated]
CVE-2026-8477 is a low-severity vulnerability in Devolutions Server that allows authenticated users with access to sealed entries to retrieve sensitive data without triggering audit notifications via crafted API requests. This issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier. The vulnerability has a CVSS score of 2.7, indicating a low severity. Administr [truncated]
CVE-2026-7325 is an improper authorization vulnerability in Devolutions Server's Active Directory browsing feature. A low-privileged authenticated user can exploit this to obtain authentication material associated with a stored PAM provider service account via authentication relay to an attacker-controlled server. This issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20. [truncated]
## Summary Devolutions Server contains an improper access control vulnerability (CWE-862) in its notification management endpoints. An unauthenticated attacker can modify or delete arbitrary user notification records due to missing session validation. The vulnerability affects Devolutions Server 2026.1.6.0 through 2026.1.15.0 and all versions through 2025.3.19.0. ## Technical Details The vulnerability exi [truncated]
A missing authorization vulnerability in Devolutions Server's Privileged Access Management (PAM) module allows authenticated users with a PAM license but no additional permissions to obtain sensitive authentication material. The flaw, published 2026-05-12 and last modified 2026-05-26, affects Devolutions Server 2026.1.6.0 through 2026.1.11.0 and versions 2025.3.16.0 and earlier. Attackers can extract OTP [truncated]
CVE-2026-2590 is a critical vulnerability in Devolutions Remote Desktop Manager 2025.3.30 and earlier where the "Disable password saving in vaults" setting is not properly enforced in the connection entry component. As described by the vendor and reflected by NVD, this can allow credentials to be stored in vault entries anyway, potentially exposing sensitive information to other users.