PT-2026-22828 · Devolutions · Devolutions Server

Publicado 2026-03-03 · Atualizado 2026-03-04 · CVE-2026-3130

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.3.15 and earlier

Description An issue exists in Devolutions Server where improper enforcement of behavioral controls can allow an authenticated attacker with delete permission to remove a Privileged Access Management (PAM) account that is currently in use. This occurs when the attacker selects the checked-out account along with at least one account that is not checked out and performs a bulk deletion operation.

Recommendations Versions prior to 2025.3.15 should be updated.

Correção

Enumeração de Fraquezas

CWE-841

Identificadores relacionados

CVE-2026-3130

Produtos afetados

Devolutions Server

Referências · 10

• https://osv.dev/vulnerability/CVE-2026-3130 · Aviso do Fabricante
• https://t.me/CVEtracker/46247 · Publicação no Telegram
• https://t.me/cveNotify/154204 · Publicação no Telegram
• https://devolutions.net/security/advisories/DEVO-2026-0005 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-3130 · Nota de Segurança
• https://twitter.com/CVEnew/status/2028959727799992667 · Publicação no Twitter
• https://t.me/cveNotify/154124 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2029100852233794031 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2028961467609858134 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2029230502792835391 · Publicação no Twitter