CVE-2026-90971 Devolutions CVE debrief

Who should care

Defenders responsible for Devolutions Server deployments, especially those with low-privileged users, should assess exposure and prioritize verification and mitigation to prevent credential theft and internal network access. This includes reviewing the Devolutions Server version, restricting access to the VMware synchronization feature, and implementing additional security measures to protect against SSRF attacks.

Why it matters

The SSRF vulnerability in Devolutions Server allows low-privileged users to obtain credentials and access internal endpoints, posing a risk to network security and data confidentiality.

• Credential theft and potential lateral movement within the network
• Access to internal or cloud-metadata network endpoints
• Potential for data breaches or unauthorized access to sensitive information
• Verification of Devolutions Server version and exposure to the vulnerability

Technical summary

The SSRF vulnerability in Devolutions Server allows a low-privileged authenticated user to submit a crafted connection definition for datacenter discovery, potentially leading to credential theft and internal network access. This vulnerability exists in Devolutions Server versions 2026.2.16 and earlier, affecting network security and data confidentiality. Defenders should assess exposure and prioritize verification and mitigation, especially for low-privileged users, to prevent potential data breaches or unauthorized access to sensitive information.

Defensive priority

Defenders should prioritize verifying exposure, especially for low-privileged users, and assess the impact of potential credential theft and internal network access.

Recommended defensive actions

• Verify the version of Devolutions Server and check if it is vulnerable (2026.2.16 or earlier)
• Restrict access to the VMware synchronization feature to minimize exposure
• Monitor for suspicious activity related to credential theft and internal network access
• Implement additional security measures to protect against SSRF attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the SSRF vulnerability in Devolutions Server. The vendor, Devolutions, has provided a security advisory (DEVO-2026-0030). Evidence is limited; defenders should verify the Devolutions Server version and check for exposure, especially for low-privileged users. The vulnerability allows credential theft and internal network access, posing a risk to network security and data confidentiality.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.