Vulnerability in Devolutions Server

[ Description ]Official description

Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund3 Nov 2026WID-SEC-2026-4306

  Devolutions Server: Multiple vulnerabilities Translated from German

  CVE-2026-120733CVE-2026-119636CVE-2026-120716+3 more CVEs

[ References ]References

• devolutions.net/security/advisories/DEVO-2026-0039