Devolutions Server: Multiple Vulnerabilities Allow Authenticated Attackers to Manipulate Data, Bypass Security, and Disclose Information

A remote, authenticated attacker can exploit multiple vulnerabilities in Devolutions Server to manipulate data, bypass security measures, and disclose information. These vulnerabilities, identified by the BSI (German Federal Office for Information Security) in July 2026, allow an attacker with legitimate access to compromise the integrity and confidentiality of data managed by the server. While specific campaign details or tool names are not provided, the nature of the vulnerabilities suggests an intent to gain unauthorized control over sensitive data and system functionalities. Organizations using Devolutions Server are advised to apply vendor updates promptly to mitigate the risk of exploitation by malicious actors seeking to leverage authenticated access for further system compromise and data theft.

Impact

Successful exploitation of these vulnerabilities by an authenticated attacker could lead to severe consequences, including the unauthorized manipulation of critical data, complete bypass of existing security controls, and the disclosure of sensitive information. Depending on the data stored and managed by Devolutions Server, this could result in intellectual property theft, privacy breaches affecting user credentials or other personal data, and disruption of IT operations. The lack of specific incident reporting prevents a quantification of victim numbers or targeted sectors, but organizations relying on Devolutions Server for privileged access management or credential storage face a direct risk of data compromise and system control loss if these vulnerabilities are left unpatched.

Recommendation

Prioritize patching Devolutions Server installations immediately upon vendor release of security updates for Devolutions Server. Regularly review and audit user permissions within Devolutions Server to ensure the principle of least privilege is enforced. Monitor Devolutions Server logs for unusual authentication attempts, data access patterns, or configuration changes, which could indicate a compromise via the vulnerabilities described in this brief.