Authorization Bypass Flaw in Devolutions Server's Virtual Gateway Component
CVE-2026-1007

7.6HIGH

Key Information:

Vendor

Devolutions

Status
Server
Vendor
CVE Published:
19 January 2026

What is CVE-2026-1007?

A vulnerability within the virtual gateway component of Devolutions Server permits attackers to bypass established IP deny rules. This security flaw compromises the system's ability to restrict access based on predefined IP addresses, potentially exposing the server to unauthorized users. Administrators should review and update their Server versions to protect against this issue.

Affected Version(s)

Server 2025.3.1 <= 2025.3.12

References

https://devolutions.net/security/advisories/DEVO-2026-0003/

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.