Devolutions Server versions 2025.3.16 and earlier have a flaw where improperly validated input in the error message page allows a remote attacker to supply a crafted URL that causes the displayed error message to be replaced with any text the attacker chooses. This can be used to mislead users, facilitate social engineering or obfuscate legitimate errors, potentially impacting the integrity and trust of the information presented by the application.

The vulnerable product is Devolutions Server, specifically the 2025.3.16 release line and all earlier revisions. Administrators running these versions should immediately review their deployments.

The vulnerability carries a very high CVSS score of 9.8, indicating critical severity, yet its EPSS is noted as less than 1%, implying a currently low probability of exploitation. The flaw is accessed remotely via a crafted URL and does not require authentication. It is not listed in the CISA KEV catalog. Because the attacker can manipulate what users see, the attack vector is likely to be web-facing and could lead to confusion or phishing attempts, but does not directly compromise data or execution.