CVE-2026-121580: Server-Side Request Forgery
Affects Devolutions ServerSource CVE Database V5
Not known to be exploited : upgrade to 2026.2.23.0 soon.
Data as of 3 Nov 2026, 20:45 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
Thin evidence
One scorer or none- Patch
- Available – fixed in 2026.2.23.0
Exploitation evidence
Disclosed: evidence found.
CVE published 3 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 3 Nov 2026.
What to do
Upgrade Devolutions Server to 2026.2.23.0.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| DevolutionsServer | Affected
| Fixed in
|
AI-suggested
Upgrade Devolutions Server to version 2026.2.23.0 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated.
Description
A server-side request forgery (SSRF) vulnerability exists in the Jira ticketing filter lookup feature of Devolutions Server versions 2026.2.22.0 and earlier. This flaw allows an authenticated user with low privileges to retrieve stored Jira service account credentials by supplying a malicious server address in the request. The vulnerability is fixed in version 2026.2.23.0.