Live › vulnerability › CVE-2026-120734
The email configuration test in Devolutions Server 2026.3.13.0 and earlier sends the stored SMTP password in cleartext when the request names an attacker-controlled SMTP host. An authenticated user with access to the test action can collect that password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:19 UTC. All times on this page are UTC.
Teams running Devolutions Server 2026.3.13.0 or earlier with an email (SMTP) notification setup. Exposure requires an authenticated user who can reach the email configuration test action; instances without SMTP configured or without such users are unlikely to be exposed. unknown whether the sources list other conditions.
No product ranges from the sources yet.
2026.3.13.0 and earlier.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.
This page as .md · .json · in your agent: get_signal("CVE-2026-120734")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.