CVE-2026-90971: Devolutions Server

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery.

Affected products

• Devolutions Server: up to and including 2026.2.16

Published 2026-09-15. Last modified 2026-09-20.