CVE-2026-1007

—

CVSS 3.1

7.6 high

EPSS

<1%p9

Published

Jan 19, 2026 (Jan 19, 2026)

Modified

Jun 17, 2026

Description

Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.

Vendors: devolutions
Products: devolutions server
Weakness: CWE-863
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.