CVE-2026-120715: SSRF

Published Nov 3, 2026

Updated

Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.

Event History

Nov 3, 2026

CVE Published

via MITRE·08:34 PM

Data Sourced

via MITRE·08:34 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionWeakness

Frequently Asked Questions

Which releases are in scope?

Devolutions Server 2026.3.12.0 and earlier are affected.

Does exploitation require prior access?

Yes. An attacker must be authenticated as a low-privileged user and supply an attacker-controlled domain name in the request.

What credential material can be exposed?

The issue can cause the DVLS service account's NetNTLMv2 hash to be captured.

CVE-2026-120715: SSRF

Event History

Frequently Asked Questions

Which releases are in scope?

Does exploitation require prior access?

What credential material can be exposed?

Company

Resources

Contact

Frequently Asked Questions

Which releases are in scope?

Does exploitation require prior access?

What credential material can be exposed?