CVE-2026-3204CWE-20

Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message…

Critical · published March 3, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

Improper

input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message via a specially crafted URL.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00661 · 51.0th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2026-03-03T21:24Z
EPSS history
Timeline
  • 03 MAR 21:24Z
    Improper input validation in the error message page in Devolutions Server 2025.3.16 and earlier allows remote attackers to spoof the displayed error message…
    cvelistv5