CVE-2026-3221
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database t…
Published Feb 25, 2026 · updated Jun 17, 2026 · devolutions devolutions server
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Feb 25, 2026 · NIST NVD
Detected
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.
Jun 17, 2026 · NIST NVD
Updated
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.
Affected
- cpe devolutions/devolutions serverversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-3221
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-3221
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.
nvd.nist.gov