BaseFortify

Publication date: 2026-01-19

Last updated on: 2026-02-10

Assigner: Devolutions Inc.

Description

Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-19

Last Modified

2026-02-10

Generated

2026-07-06

AI Q&A

2026-01-19

EPSS Evaluated

2026-07-05

NVD

CVE-2026-1007

EUVD

EUVD-2026-3217

Affected Vendors & Products

Vendor	Product	Version / Range
devolutions	devolutions_server	From 2025.3.1.0 (inc) to 2025.3.14.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an Incorrect Authorization issue in the virtual gateway component of Devolutions Server. It allows attackers to bypass deny IP rules, meaning unauthorized IP addresses that should be blocked can gain access.

Impact Analysis

The impact of this vulnerability is that attackers can bypass IP-based access restrictions, potentially allowing unauthorized access to the server or its resources, which could lead to security breaches.

Hi! I’m here to help you understand CVE-2026-1007. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70