CVE-2026-110805 Devolutions CVE debrief

Who should care

Devolutions Server administrators and security teams should assess exposure and prioritize remediation to prevent potential exfiltration of sensitive information. This includes verifying Devolutions Server version and exposure, restricting access to the PingOne groups endpoint, and monitoring for suspicious activity related to PingOne application secrets.

Why it matters

CVE-2026-110805 is a server-side request forgery vulnerability in Devolutions Server that allows an authenticated low-privileged user to exfiltrate PingOne application secrets. Devolutions Server administrators and security teams should assess exposure and prioritize remediation to prevent potential exfiltration of sensitive information.

• Potential exfiltration of PingOne application secrets
• Increased risk of unauthorized access to sensitive information
• Need for verification of Devolutions Server version and exposure
• Potential impact on security posture due to server-side request forgery

Technical summary

CVE-2026-110805 is a server-side request forgery vulnerability in the PingOne groups endpoint of Devolutions Server versions 2026.3.8.0 and earlier. An authenticated low-privileged user can exploit this vulnerability to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter. The vulnerability has a significant impact on the security posture of affected systems, allowing potential exfiltration of sensitive information and increased risk of unauthorized access.

Defensive priority

Devolutions Server administrators should prioritize verifying exposure and applying remediation, if available, to prevent potential exfiltration of sensitive information.

Recommended defensive actions

• Verify Devolutions Server version and exposure to CVE-2026-110805
• Restrict access to the PingOne groups endpoint
• Monitor for suspicious activity related to PingOne application secrets
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description and source metadata indicate a server-side request forgery vulnerability in Devolutions Server, allowing an authenticated low-privileged user to exfiltrate the stored PingOne application secret.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.