CVE-2025-3517: Devolutions Server

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

Incorrect privilege assignment in PAM JIT elevation feature in Devolutions Server 2025.1.5.0 and earlier allows a PAM user to elevate a previously configured user configured in a PAM JIT account via failure to update the internal account’s SID when updating the username.

Affected products

• Devolutions Devolutions Server: before 2025.1.6.0 (fixed in 2025.1.6.0)

Published 2025-05-01. Last modified 2026-06-17.