Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.6

Devolutions Server can leak PingOne secret to low‑privilege users

CVE-2026-110805 · published 2 days ago
Summary

In Devolutions Server versions up to 2026.3.8.0, a low‑privilege account can trick the system into sending out the stored PingOne application secret. This happens because the server can be made to request external resources on behalf of the attacker. Upgrade to a newer release or apply the vendor's patch to stop the unauthorized data exposure.

What to do
  • Update devolutions server to version 2026.3.10 or later.
Affected software
VendorProductAffected versions
devolutions server < 2026.3.10
Original advisory text
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret v...
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
2.6 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published16 Oct 2026
Updated17 Oct 2026
First seen16 Oct 2026
Sources
CVE-2026-110805 · NVD
CVE-2026-110805 · MITRE
Track software like this
Free during beta