[ CVE-2026-120716 · Published 3 Nov 2026 ]

Vulnerability in Devolutions Server

Not scored yet EPSS <1%1 agency advisoryNo fix listed yet

[ Description ]Official description

Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

BSI CERT-Bund3 Nov 2026WID-SEC-2026-4306

Devolutions Server: Multiple vulnerabilities Translated from German
CVE-2026-120733CVE-2026-119636CVE-2026-120716+3 more CVEs

[ References ]References

devolutions.net/security/advisories/DEVO-2026-0039

[ Description ]Official description

[ Fixes ]Fixes and patches

[ Advisories ]Government CERT advisories

Devolutions Server: Multiple vulnerabilities Translated from German

[ References ]References