Devolutions vulnerabilities (CVEs)

100 CVEs matched to Devolutions by name in NVD, none on CISA's Known Exploited list.

Back to the Devolutions profile · Alternatives to Devolutions · CVE RSS feed

Exploitation riskProbably exploited

100 of 100 CVEs assessed

confirmed exploited

EPSS ≥ 10%

62%

highest single CVE

7 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.

Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.

CVE-2021-42098 ↗EPSS 1.8%LEV ≥62%Probably exploited
An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to bypass permissions via batch custom PowerSh…
CVE-2022-33995 ↗EPSS 2.0%LEV ≥59%Probably exploited
A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary lo…
CVE-2021-23922 ↗EPSS 1.4%LEV ≥54%Probably exploited

Recent changes

last 90 days

CVE-2025-2277 is now estimated at a 10% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-10-20 · NVD ↗
CVE-2024-1901 is now estimated at a 10% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-22 · NVD ↗
CVE-2024-4846 is now estimated at a 10% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-20 · NVD ↗
CVE-2023-5765 is now estimated at a 19% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗
CVE-2023-1580 is now estimated at a 23% chance of having already been exploited, despite not appearing on CISA's Known Exploited Vulnerabilities catalog.2026-09-01 · NVD ↗

CVE severity over time

CVEs by year and severity

Count of matched CVEs by the year NVD published them.
Year	Critical	High	Medium	Low	Unscored	Total
2025	0	9	13	1	0	23
2024	2	5	19	1	1	28
2023	3	5	18	2	0	28
2022	0	6	5	0	0	11
2021	1	4	4	1	0	10

Highest EPSS scores

EPSS is FIRST's estimate of the chance a CVE is exploited in the next 30 days. It measures likelihood, not impact.

CVE	EPSS	Percentile
CVE-2022-33995	2.0%	80%
CVE-2021-42098	1.8%	78%
CVE-2025-1635	1.8%	78%
CVE-2025-1636	1.8%	78%
CVE-2021-23922	1.4%	73%
CVE-2022-2221	1.3%	71%
CVE-2021-28047	1.2%	69%
CVE-2022-33996	1.1%	65%
CVE-2022-4287	1.1%	65%
CVE-2023-1203	1.1%	64%

Known CVEs (100)

RSS ⇢

CVE-2025-6741 ↗HIGH 7.72025
Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message entry attachment feature This issue affect…
CVE-2025-6523 ↗HIGH 7.72025
Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forcing the short emergency codes generated by…
↗

How this is counted

CVEs come from the US National Vulnerability Database (NVD) and are matched to Devolutions by vendor name. A name match can include CVEs that concern a similarly named product, and can miss ones filed under another name. The count reflects how widely a vendor's software is deployed and examined as much as anything else, so it is not a measure of how secure the vendor is and should not be used to rank vendors. Latest CVE added here: 2026-07-17.
Known-exploited status comes from the CISA Known Exploited Vulnerabilities (KEV) catalog. Last checked: 2026-10-20.
Exploit probability (EPSS) comes from FIRST. Latest score date: 2026-10-20.