CVE-2026-3221CWE-312

Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the…

Medium · published February 25, 2026

CVSS v3.1
4.9
EPSS
0%
Percentile
17.1
In the wild
Unconfirmed
What it is

Sensitive

user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with

access to the database to obtain sensitive user

information via direct database access.

The record
Technical detail
CVSS v3.1
4.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00263 · 17.1th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2026-02-25T18:29Z
EPSS history
Timeline
  • 25 FEB 18:29Z
    Sensitive user account information is not encrypted in the database in Devolutions Server 2025.3.14 and earlier, which allows an attacker with access to the…
    cvelistv5