CVE-2026-3224CRITICAL 9.8EPSS p39.2%

CVE-2026-3224CVE-2026-3224

Description

Authentication bypass in the Microsoft Entra ID (Azure AD) authentication mode in Devolutions Server 2025.3.15.0 and earlier allows an unauthenticated user to authenticate as an arbitrary Entra ID user via a forged JSON Web Token (JWT).

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.51% probability of exploitation · percentile 39.2% · 2026-06-19T12:03:05Z
Published2026-03-03
Last modified2026-03-05

Underlying weaknesses· 1

CWE-287

References

  1. https://devolutions.net/security/advisories/DEVO-2026-0005/

1

TypeTargetConfidenceTier
WeaknessImproper Authenticationcwe-2870%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-4828
CVE
CVE-2026-4924
CVE
CVE-2025-12485
CVE
CVE-2026-10786
CVE
CVE-2025-11957
CVE
CVE-2025-2280
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.