CVE-2026-3130

—

CVSS 3.1

9.8 critical

EPSS

<1%p38

Published

Mar 3, 2026 (Mar 3, 2026)

Modified

Jun 17, 2026

Description

Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing a bulk deletion.

Vendors: devolutions
Products: devolutions server
Weakness: CWE-841
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.