CVE-2026-3130
Devolutions Server ≤ 2025.3.16.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-3130 is a critical-severity Improper Enforcement of Behavioral Workflow (CWE-841) vulnerability in Devolutions Devolutions Server. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked at the 37th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-11 (Re-authentication) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-3130 is an Improper Enforcement of Behavioral Controls vulnerability (CWE-841) in Devolutions Server versions 2025.3.15 and earlier. Published on 2026-03-03T22:16:29.280, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw enables improper handling of bulk deletions for PAM accounts, bypassing protections for checked-out entries.
An authenticated attacker possessing delete permission can exploit this vulnerability over the network with low complexity and no user interaction. By selecting a currently checked-out PAM account alongside at least one non-checked-out account and initiating a bulk deletion, the attacker can delete the protected checked-out account, potentially leading to high impacts on confidentiality, integrity, and availability.
The Devolutions security advisory DEVO-2026-0005 at https://devolutions.net/security/advisories/DEVO-2026-0005 provides further details on the issue, including recommended mitigations and patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9336
Vulnerability Data
Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a PAM account that is currently checked out by selecting it alongside at least one non-checked-out account and performing…
more
a bulk deletion.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V7.2.1
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement can require each successive workflow step to present the proper authorization context before proceeding.
Re-authentication requirements can be placed at critical workflow steps to ensure the actor has performed prior behaviors.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices directly address proper workflow enforcement during design and coding.
Enforcing authorization policies can include sequence constraints on multi-step actions.
Hardened configuration baselines can embed required workflow ordering rules.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect workflow bypasses but does not enforce them at runtime.
Secure development lifecycle requires explicit workflow enforcement in multi-step processes.
Application security requirements include sequencing and state-transition rules for critical workflows.
Secure architecture principles address proper ordering of security-critical operations.
Secure coding practices can prevent missing workflow checks but do not define the control itself.
Change management can require workflow adherence for changes but is not the primary mitigation.