Devolutions: >> Devolutions Server >> 2025.3.15.0 Security Vulnerabilities
Improper certificate validation in the PAM propagation WinRM connections
allows a network attacker to perform a man-in-the-middle attack via
disabled TLS certificate verification.
CVSS Score
8.1
EPSS Score
0.0
Published
2026-03-20
Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.
CVSS Score
9.8
EPSS Score
0.0
Published
2026-03-03
Improper
input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.
CVSS Score
9.8
EPSS Score
0.001
Published
2026-03-03
Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).
CVSS Score
9.8
EPSS Score
0.001
Published
2026-03-03
Page 3