Seguridad & cumplimiento normativo
Mantenemos los estándares más exigentes para proteger sus datos y garantizar la confianza.
DEVO-2026-0039
Devolutions Server is affected by multiple vulnerabilities.
Productos afectados
Registro de cambios
Initial publication - 2026-11-03
SSRF exposing stored Jira credentials in ticketing filter lookup
8.6 High - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.
CVE(s)
CVE-2026-121580
Corrección y soluciones alternativas
Upgrade to Devolutions Server 2026.2.23.0 or higher.
Créditos
d3vilx000r
Cleartext storage of TOTP secrets in user account data
5.9 Medium - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.5.0 through 2026.3.12.0 and 2026.2.22.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.
CVE(s)
CVE-2026-120733
Corrección y soluciones alternativas
Upgrade to Devolutions Server 2026.3.13.0 or higher, 2026.2.23.0 or higher.
SSRF in Active Directory credential validation
4.3 Medium - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.5.0 through 2026.3.12.0 and 2026.2.22.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.
CVE(s)
CVE-2026-120715
Corrección y soluciones alternativas
Upgrade to Devolutions Server 2026.3.13.0 or higher, 2026.2.23.0 or higher.
Créditos
dorjoo
Cleartext transmission of stored SMTP password in email configuration test
2.7 Low - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.5.0 through 2026.3.12.0 and 2026.2.22.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.
CVE(s)
CVE-2026-120734
Corrección y soluciones alternativas
Upgrade to Devolutions Server 2026.3.13.0 or higher, 2026.2.23.0 or higher.
Créditos
d3vilx000r
Expired PAM checkouts not checked in, skipping password rotation
2.3 Low - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2026.3.12.0 and earlier allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.
CVE(s)
CVE-2026-119636
Corrección y soluciones alternativas
Upgrade to Devolutions Server 2026.3.13.0 or higher, 2026.2.23.0 or higher.
Sensitive MFA data exposed by identity provider user sync
2.1 Low - CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.5.0 through 2026.3.12.0 and 2026.2.22.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.
CVE(s)
CVE-2026-120716
Corrección y soluciones alternativas
Upgrade to Devolutions Server 2026.3.13.0 or higher, 2026.2.23.0 or higher.