Live › vulnerability › CVE-2026-120715
Devolutions Server 2026.3.12.0 and earlier has a server-side request forgery flaw in its Active Directory credential validation. An authenticated low-privileged user can make the server send an attacker-controlled domain name, capturing the NetNTLMv2 hash of the DVLS service account.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Organizations running Devolutions Server 2026.3.12.0 or earlier that use Active Directory credential validation. Any low-privileged authenticated user can trigger the flaw, so the exposure is wider than administrators. Instances on a later version, or without Active Directory validation in use, are not described as affected.
No product ranges from the sources yet.
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.
This page as .md · .json · in your agent: get_signal("CVE-2026-120715")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.