CVE-2026-3204
Published: 03 March 2026
Summary
CVE-2026-3204 is a critical-severity Improper Input Validation (CWE-20) vulnerability in Devolutions Devolutions Server. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-11 (Error Handling).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 mandates validation of information inputs, directly preventing exploitation via specially crafted URLs lacking proper validation in the error message page.
SI-11 requires error handling that avoids generating harmful or discernible error messages, blocking the spoofing of displayed content from invalid inputs.
SI-15 enforces output filtering to protect against malicious content insertion or exploitation in displayed error pages.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remotely exploitable flaw (CWE-20) in a public-facing Devolutions Server web application that allows unauthenticated attackers to manipulate error-page content via crafted URLs, directly matching the definition of T1190 (Exploit Public-Facing Application).
NVD Description
Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.
Deeper analysisAI
CVE-2026-3204, published on 2026-03-03, involves improper input validation (CWE-20) in the error message page of Devolutions Server versions 2025.3.16 and earlier. This flaw allows remote attackers to spoof the displayed error message through a specially crafted URL. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its high potential impact on confidentiality, integrity, and availability.
Any remote attacker can exploit this vulnerability over the network with low attack complexity, without needing privileges or user interaction. Exploitation involves sending a malicious URL that manipulates the error page, enabling the attacker to control the spoofed message content and potentially deceive users or systems.
Mitigation guidance is available in the vendor's security advisory DEVO-2026-0005 at https://devolutions.net/security/advisories/DEVO-2026-0005.
Details
- CWE(s)