CVE-2026-3130 - Vulnerability Analysis

Overview

Devolutions Server <= 2025.3.15 contains a broken access control caused by improper enforcement of behavioral controls in bulk deletion, letting authenticated attackers with delete permission delete checked-out PAM accounts.

Severity & Score

Impact

Authenticated attackers with delete permission can delete active PAM accounts, potentially disrupting access management.

Mitigation

Update to a version later than 2025.3.15 or the latest available version.

References

• https://devolutions.net/security/advisories/DEVO-2026-0005

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 4, 2026

🔴 CVE-2026-3130 - Critical (9.8) Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-c... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-3130/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner