CVE-2026-110805

LOWCVSS 2.6 · LOW

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

https://devolutions.net/security/advisories/DEVO-2026-0036/

Weakness type (CWE)

CWE-918

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Deep dive

Full discourse1 post

CVE@CVEnew1d
CVE-2026-110805 Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the st… https://www.cve.org/CVERecord?id=CVE-2026-110805
00000557
58.2K followersView on X

Explore more

Back to dashboard