CVE-2026-12755 Server-side request forgery in Server
An authenticated user can force the server to authenticate to an attacker-controlled host, exposing PAM provider credentials via NTLMv2 challenge-response.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-12755?
CVE-2026-12755 is a low-severity server-side request forgery vulnerability in Devolutions Devolutions Server, published on 25 Jun 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper input validation in the PAM AD discovery endpoints in Devolutions Server 2026.2.4.0 through 2026.2.7.0 allows an authenticated user with the UserGroupsView permission to coerce server-side authentication to an attacker-controlled host, exposing PAM provider credentials as a NTLMv2 challenge-response, via a crafted DomainName parameter.
Weakness: CWE-1284
Which versions are affected by CVE-2026-12755?
It affects 1 product.
Products include Devolutions Devolutions Server.
How do I fix CVE-2026-12755?
No fix has been published for CVE-2026-12755 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-12755 being exploited?
There is no known exploitation of CVE-2026-12755 in the wild and no public exploit code.
Other vulnerabilities in Devolutions Devolutions Server
Sources
Also known as GHSA-6vpw-rmvh-qc2w.