{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/devolutions-server--2026.3.12.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-120733"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Devolutions Server (\u003c= 2026.3.12.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Devolutions"],"content_html":"\u003cp\u003eCVE-2026-120733 identifies a security vulnerability in Devolutions Server 2026.3.12.0 and earlier where TOTP shared secrets are stored in cleartext within the user account database. This occurs when an administrator saves a user, causing an unencrypted copy of the security key to be written to the database. An attacker with unauthorized read access to the application database or database backups can extract these secrets to facilitate MFA bypass or unauthorized access.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eAn attacker with read access to the underlying database or database backups can retrieve plaintext TOTP secrets, effectively neutralizing the security provided by multi-factor authentication for affected accounts.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Devolutions Server to the version containing the fix for CVE-2026-120733.\u003c/li\u003e\n\u003cli\u003eAudit access controls for the database and backup locations to ensure only authorized service accounts and administrators have read access.\u003c/li\u003e\n\u003cli\u003eRotate TOTP secrets for all user accounts after patching to mitigate the risk of previously exposed secrets.\u003c/li\u003e\n\u003cli\u003eImplement strict database logging to detect unauthorized read access or anomalous query patterns targeting the user account data.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T21:29:48Z","date_published":"2026-11-06T21:29:48Z","id":"https://feed.craftedsignal.io/briefs/2026-11-devolutions-cleartext-totp/","summary":"Devolutions Server versions 2026.3.12.0 and earlier store TOTP shared secrets in cleartext, allowing an attacker with database access to extract secrets and compromise MFA.","title":"Devolutions Server: Cleartext storage of TOTP shared secrets (CVE-2026-120733)","url":"https://feed.craftedsignal.io/briefs/2026-11-devolutions-cleartext-totp/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:devolutions:devolutions_server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-120715"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Devolutions Server (\u003c= 2026.3.12.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Devolutions"],"content_html":"\u003cp\u003eDevolutions Server versions 2026.3.12.0 and earlier are affected by a server-side request forgery (SSRF) vulnerability in the Active Directory credential validation functionality. An authenticated low-privileged user can supply an attacker-controlled domain name to the validation endpoint, forcing the server to authenticate against the external host. This results in the leakage of the DVLS service account's NetNTLMv2 hash to the attacker.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows a low-privileged user to obtain the NetNTLMv2 hash of the service account, which can be subsequently cracked offline or used for NTLM relay attacks to gain further access within the Active Directory environment.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Devolutions Server to the version containing the fix for CVE-2026-120715.\u003c/li\u003e\n\u003cli\u003eAudit logs for the Active Directory credential validation endpoint to identify unusual or external domain requests.\u003c/li\u003e\n\u003cli\u003eMonitor service account activity for signs of unauthorized NTLM authentication or relay attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T21:29:42Z","date_published":"2026-11-06T21:29:42Z","id":"https://feed.craftedsignal.io/briefs/2026-11-devolutions-ssrf/","summary":"An authenticated low-privileged user can exploit a server-side request forgery (SSRF) vulnerability in Devolutions Server 2026.3.12.0 and earlier to capture the NetNTLMv2 hash of the service account.","title":"Devolutions Server: Active Directory credential validation SSRF (CVE-2026-120715)","url":"https://feed.craftedsignal.io/briefs/2026-11-devolutions-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Devolutions Server (\u003c= 2026.3.12.0)","version":"https://jsonfeed.org/version/1.1"}