https://feed.craftedsignal.io/cpes/cpe2.3adevolutionsdevolutions_server/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 06 Nov 2026 21:29:48 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-11-devolutions-cleartext-totp/Fri, 06 Nov 2026 21:29:48 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-devolutions-cleartext-totp/Devolutions Server versions 2026.3.12.0 and earlier store TOTP shared secrets in cleartext, allowing an attacker with database access to extract secrets and compromise MFA.CVE-2026-120733 identifies a security vulnerability in Devolutions Server 2026.3.12.0 and earlier where TOTP shared secrets are stored in cleartext within the user account database. This occurs when an administrator saves a user, causing an unencrypted copy of the security key to be written to the database. An attacker with unauthorized read access to the application database or database backups can extract these secrets to facilitate MFA bypass or unauthorized access.

Impact

An attacker with read access to the underlying database or database backups can retrieve plaintext TOTP secrets, effectively neutralizing the security provided by multi-factor authentication for affected accounts.

Recommendation

• Upgrade Devolutions Server to the version containing the fix for CVE-2026-120733.
• Audit access controls for the database and backup locations to ensure only authorized service accounts and administrators have read access.
• Rotate TOTP secrets for all user accounts after patching to mitigate the risk of previously exposed secrets.
• Implement strict database logging to detect unauthorized read access or anomalous query patterns targeting the user account data.

]]>highadvisoryhttps://feed.craftedsignal.io/briefs/2026-11-devolutions-ssrf/Fri, 06 Nov 2026 21:29:42 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-devolutions-ssrf/An authenticated low-privileged user can exploit a server-side request forgery (SSRF) vulnerability in Devolutions Server 2026.3.12.0 and earlier to capture the NetNTLMv2 hash of the service account.Devolutions Server versions 2026.3.12.0 and earlier are affected by a server-side request forgery (SSRF) vulnerability in the Active Directory credential validation functionality. An authenticated low-privileged user can supply an attacker-controlled domain name to the validation endpoint, forcing the server to authenticate against the external host. This results in the leakage of the DVLS service account's NetNTLMv2 hash to the attacker.

Impact

Successful exploitation allows a low-privileged user to obtain the NetNTLMv2 hash of the service account, which can be subsequently cracked offline or used for NTLM relay attacks to gain further access within the Active Directory environment.

Recommendation

• Upgrade Devolutions Server to the version containing the fix for CVE-2026-120715.
• Audit logs for the Active Directory credential validation endpoint to identify unusual or external domain requests.
• Monitor service account activity for signs of unauthorized NTLM authentication or relay attempts.

]]>highadvisory