PT-2026-3442 · Devolutions · Devolutions Server

Published 2026-01-19 · Updated 2026-02-10 · CVE-2026-1007

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions Devolutions Server versions 2025.3.1 through 2025.3.12

Description An incorrect authorization issue exists in the virtual gateway component of Devolutions Server. This allows attackers to bypass deny IP rules.

Recommendations Update Devolutions Server to a version later than 2025.3.12.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-1007

Affected Products

Devolutions Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-1007 · Security Note
• https://osv.dev/vulnerability/CVE-2026-1007 · Vendor Advisory
• https://devolutions.net/security/advisories/DEVO-2026-0003 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2013278225607045342 · Twitter Post
• https://twitter.com/CVEnew/status/2013270791228440961 · Twitter Post
• https://t.me/cveNotify/151592 · Telegram Post