CVE-2026-110805
Undergoing Analysis Undergoing Analysis - In Progress

Server-Side Request Forgery in Devolutions Server 2026.3.8.0

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Devolutions Inc.

Description
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110805
EUVD
EUVD-2026-102877

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Devolutions Server 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a server-side request forgery (SSRF) in the PingOne groups endpoint of Devolutions Server versions 2026.3.8.0 and earlier. An authenticated user with low privileges can exploit this by manipulating a request parameter to control the PingOne configuration. This allows them to exfiltrate the stored PingOne application secret.

Impact Analysis

If exploited, this vulnerability could allow an attacker to steal sensitive credentials like the PingOne application secret. This could lead to unauthorized access to systems, data breaches, or further compromise of the affected environment.

Mitigation Strategies

Update Devolutions Server to a version newer than 2026.3.8.0 to address the server-side request forgery vulnerability in the PingOne groups endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110805. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart