Devolutions Server: Active Directory credential validation SSRF (CVE-2026-120715)
An authenticated low-privileged user can exploit a server-side request forgery (SSRF) vulnerability in Devolutions Server 2026.3.12.0 and earlier to capture the NetNTLMv2 hash of the service account.
CVE search metadata
CVE search record: CVE-2026-120715. Severity: high. CVSS: 8.1. EPSS: 0.14%. KEV: no. Product: Devolutions Server (<= 2026.3.12.0). Brief: Devolutions Server: Active Directory credential validation SSRF (CVE-2026-120715). Brief link: https://feed.craftedsignal.io/briefs/2026-11-devolutions-ssrf/
Triage facts
Revision 1- Applicability
- Devolutions Server (<= 2026.3.12.0)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 6, 21:29 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Devolutions Server versions 2026.3.12.0 and earlier are affected by a server-side request forgery (SSRF) vulnerability in the Active Directory credential validation functionality. An authenticated low-privileged user can supply an attacker-controlled domain name to the validation endpoint, forcing the server to authenticate against the external host. This results in the leakage of the DVLS service account's NetNTLMv2 hash to the attacker.
Impact
Successful exploitation allows a low-privileged user to obtain the NetNTLMv2 hash of the service account, which can be subsequently cracked offline or used for NTLM relay attacks to gain further access within the Active Directory environment.
Recommendation
- Upgrade Devolutions Server to the version containing the fix for CVE-2026-120715.
- Audit logs for the Active Directory credential validation endpoint to identify unusual or external domain requests.
- Monitor service account activity for signs of unauthorized NTLM authentication or relay attempts.
Immediate actions
Upgrade Devolutions Server to the patched version that addresses CVE-2026-120715.
Threat Hunt
Identify authenticated users submitting requests to the Active Directory validation endpoint that include external, non-corporate domain names.
Data: Application request logs, Web server logs
Mitigations
Apply security updates for Devolutions Server to remediate CVE-2026-120715.
CVE-2026-120715