Server-Side Request Forgery in Devolutions Server Affects User Credential Security
CVE-2026-120715

8.1HIGH

Key Information:

Vendor

Devolutions

Status
Server
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120715?

A vulnerability in Devolutions Server versions up to 2026.3.12.0 allows an authenticated low-privileged user to exploit server-side request forgery. This enables attackers to capture the sensitive NetNTLMv2 hash of the DVLS service account by leveraging an attacker-controlled domain name in the request, potentially leading to unauthorized access and credential compromise.

Affected Version(s)

Server 0 < 2026.3.13.0

References

https://devolutions.net/security/advisories/DEVO-2026-0039/

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.