PT-2026-22828 · Devolutions · Devolutions Server

Published 2026-03-03 · Updated 2026-03-04 · CVE-2026-3130

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.3.15 and earlier

Description An issue exists in Devolutions Server where improper enforcement of behavioral controls can allow an authenticated attacker with delete permission to remove a Privileged Access Management (PAM) account that is currently in use. This occurs when the attacker selects the checked-out account along with at least one account that is not checked out and performs a bulk deletion operation.

Recommendations Versions prior to 2025.3.15 should be updated.

Fix

Weakness Enumeration

CWE-841

Related Identifiers

CVE-2026-3130

Affected Products

Devolutions Server

References · 10

• https://osv.dev/vulnerability/CVE-2026-3130 · Vendor Advisory
• https://devolutions.net/security/advisories/DEVO-2026-0005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3130 · Security Note
• https://t.me/CVEtracker/46247 · Telegram Post
• https://t.me/cveNotify/154204 · Telegram Post
• https://twitter.com/CVEnew/status/2028959727799992667 · Twitter Post
• https://t.me/cveNotify/154124 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029100852233794031 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028961467609858134 · Twitter Post
• https://twitter.com/TheHackerWire/status/2029230502792835391 · Twitter Post