CVE-2026-3221

—

CVSS 3.1

4.9 medium

EPSS

<1%p5

Published

Feb 25, 2026 (Feb 25, 2026)

Modified

Jun 17, 2026

Description

Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.

Vendors: devolutions
Products: devolutions server
Weakness: CWE-312
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.2%)

In the news0 stories

No ingested article mentions this CVE yet.