SQL Injection Vulnerability in Devolutions Server by Devolutions
CVE-2026-0610

9.8CRITICAL

Key Information:

Vendor: Devolutions
Status: Server
Vendor: CVE Published:; 19 January 2026

🔔 Create Devolutions Vulnerability Alert

What is CVE-2026-0610?

An SQL Injection vulnerability exists in Devolutions Server that affects remote session management. This security flaw allows attackers to execute unauthorized SQL commands, potentially compromising sensitive data and user access. The vulnerability impacts multiple versions of Devolutions Server from 2025.3.1 to 2025.3.12, necessitating prompt action for mitigation as highlighted in the advisory.

Affected Version(s)

Server 2025.3.1 <= 2025.3.12

References

https://devolutions.net/security/advisories/DEVO-2026-0003/

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jan 19, 2026
Vulnerability Reserved
Jan 5, 2026

CVE-2026-0610 Data

JSON