CVE-2026-100288: Devolutions Devolutions Server vulnerability
Cleartext storage of sensitive information in the database in Devolutions Server 2026.3.5.0 and earlier allows an attacker with read access to the database to obtain external identity provider tokens and active session identifiers via direct inspection of stored records.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs read access to the Devolutions Server database. They can obtain external identity provider tokens and active session identifiers by directly inspecting stored records.
Which deployments are affected?
Devolutions Server 2026.3.5.0 and earlier are affected. The provided information does not identify any configuration prerequisite beyond the attacker having database read access.
What should teams prioritize while remediation is pending?
Restrict database read access to only authorized accounts and systems, because direct access to stored records is the stated exploitation path. Treat potentially exposed external identity provider tokens and active session identifiers as sensitive.