Devolutions Server Sealed Entry Notification Bypass Vulnerability

A vulnerability in Devolutions Server's entry sensitive-data retrieval feature allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification. This is achieved through a crafted API request. The issue affects Devolutions Server versions 2026.1.6.0 through 2026.1.16.0, as well as versions 2025.3.20.0 and earlier.

Impact

Exploitation of this vulnerability allows for unauthorized retrieval of sensitive data from sealed entries, bypassing established audit notification protocols.

Remediation

Users are advised to upgrade to Devolutions Server version 2026.1.19.0 or higher, or version 2025.3.22.0 or higher.