CVE-2026-90971

Received Received - Intake

SSRF in Devolutions Server via Datacenter Discovery

Publication date: 2026-09-15

Last updated on: 2026-09-20

Assigner: Devolutions Inc.

Description

Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-20

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-90971

EUVD

EUVD-2026-79181

Affected Vendors & Products

Vendor	Product	Version / Range
devolutions	server	2026.2.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Devolutions Server 2026.2.16 and earlier versions. It allows a low-privileged authenticated user to trick the server into making unauthorized requests to internal or cloud-metadata endpoints. By submitting a crafted connection definition for datacenter discovery, an attacker can obtain other users' credentials.

Impact Analysis

An attacker could exploit this to access sensitive internal systems, steal user credentials, or interact with cloud-metadata services. This may lead to unauthorized data access, privilege escalation, or further network compromise depending on the exposed endpoints.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Update Devolutions Server to a version later than 2026.2.16 to address the SSRF vulnerability in the synchronization feature.

Hi! I’m here to help you understand CVE-2026-90971. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70