CVE-2026-3221

Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2026-0004/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*

History

17 Jun 2026, 10:43

Type	Values Removed	Values Added
Summary		(es) Hay información sensible de cuentas de usuario que no está cifrada en la base de datos en Devolutions Server 2025.3.14 y versiones anteriores, lo que permite a un atacante con acceso a la base de datos obtener información sensible del usuario a través del acceso directo a la base de datos.

28 Feb 2026, 00:43

Type	Values Removed	Values Added
First Time		Devolutions Devolutions devolutions Server
References	~~() https://devolutions.net/security/advisories/DEVO-2026-0004/ -~~	() https://devolutions.net/security/advisories/DEVO-2026-0004/ - Vendor Advisory
CPE		cpe:2.3:a:devolutions:devolutions_server::::::::

26 Feb 2026, 16:24

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 4.9

25 Feb 2026, 19:43

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-02-25 19:43

Updated : 2026-06-17 10:43

NVD link : CVE-2026-3221

Mitre link : CVE-2026-3221

CVE.ORG link : CVE-2026-3221

JSON object : View

Products Affected

devolutions

devolutions_server

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2026-3221", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-3221", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T16:02:33.571666Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "Server", "versions": [{"status": "affected", "version": "0", "lessThan": "2025.3.15", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-02-25T19:43:26.530", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0004/", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "Sensitive\n user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with \naccess to the database to obtain sensitive user \ninformation via direct database access."}, {"lang": "es", "value": "Hay informaci\u00f3n sensible de cuentas de usuario que no est\u00e1 cifrada en la base de datos en Devolutions Server 2025.3.14 y versiones anteriores, lo que permite a un atacante con acceso a la base de datos obtener informaci\u00f3n sensible del usuario a trav\u00e9s del acceso directo a la base de datos."}], "lastModified": "2026-06-17T10:43:14.483", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6DB87A4B-D40B-442F-8BF5-CA935BFADB3D", "versionEndExcluding": "2025.3.15.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}