CVE-2026-3221 Information disclosure in Server
Attackers with database access can read sensitive user account information because it is stored unencrypted in Devolutions Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3221?
CVE-2026-3221 is a medium-severity vulnerability in Devolutions Devolutions Server, published on 25 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the database to obtain sensitive user information via direct database access.
Weakness: CWE-312
Which versions are affected by CVE-2026-3221?
It affects 1 product.
Products include Devolutions Devolutions Server.
How do I fix CVE-2026-3221?
No fix has been published for CVE-2026-3221 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-3221 being exploited?
There is no known exploitation of CVE-2026-3221 in the wild and no public exploit code.
Other vulnerabilities in Devolutions Devolutions Server
Sources
Also known as GHSA-p2jg-7vxg-x4vp.