PatchTheCVECVE-2026-110805: Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an
10
Routine
LOW 2.6UPGRADE
CVE-2026-110805 is a low-severity flaw (CVSS 2.6) affecting devolutions server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne application secret via an attacker-controlled PingOne configuration in the request parameter.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 2.6 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.1% (top 98%) |
| CISA exploited list | No |
| Weakness | CWE-918 |
| Published | 2026-10-16 |
| Last modified | 2026-10-23 |
Publisher (CNA): Devolutions Inc. · Vendor: devolutions
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
devolutions devolutions server UPGRADE
Affected: < 2026.2.20.0 · >= 2026.3.5.0 and < 2026.3.10.0
Fixed in: 2026.2.20.0, 2026.3.10.0
Safe to downgrade to: a release before 2026.3.5.0
1. Check installed version
apt-cache policy devolutions-server || rpm -q devolutions-server || devolutions-server --version
2. UPGRADE to 2026.2.20.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade devolutions-server
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade devolutions-server
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2026.3.5.0 (Debian / Ubuntu)
apt-cache madison devolutions-server
sudo apt install devolutions-server=<VERSION_BEFORE_2026.3.5.0>
sudo apt-mark hold devolutions-server
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list devolutions-server
sudo dnf downgrade devolutions-server-<VERSION_BEFORE_2026.3.5.0>
sudo dnf versionlock add devolutions-server
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-110804 MEDIUM 4.3 UPGRADE Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0
- CVE-2026-110806 MEDIUM 6.5 UPGRADE Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authentica
- CVE-2026-110287 MEDIUM 4.3 UPGRADE Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authe