CVE-2026-120715 in Server
Summary
by MITRE • 11/03/2026
Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The vulnerability identified as a server-side request forgery within the Active Directory credential validation mechanism of Devolutions Server versions 2026.3.12.0 and earlier represents a critical authentication bypass risk that leverages misconfigured network trust relationships to extract sensitive cryptographic material from domain controllers. This flaw specifically targets the process by which the application validates user credentials against an external Active Directory infrastructure, exposing the internal service account used for this communication channel to interception attacks. The core technical deficiency lies in the lack of strict validation or allow-listing of target domains during the authentication handshake phase, allowing a malicious actor to redirect credential verification requests toward attacker-controlled entities rather than legitimate domain controllers within the organization's trusted forest.
From an operational perspective, this vulnerability enables an authenticated low-privileged user to execute what is effectively a relay attack against the Devolutions Server service account. By crafting a request that includes an attacker-controlled domain name in the authentication payload, the victim server initiates a challenge-response exchange with the malicious entity instead of the intended Active Directory controller. This interaction results in the generation and transmission of NetNTLMv2 hashes associated with the DVLS service account to the attacker's infrastructure. The capture of these hashes is particularly dangerous because they are not static passwords but rather dynamic cryptographic responses that can be utilized for pass-the-hash attacks, allowing an adversary to impersonate the high-privilege service account without ever needing to crack or decrypt the underlying password.
The impact of this vulnerability extends beyond simple credential theft, as it facilitates lateral movement and potential full domain compromise if the DVLS service account possesses elevated permissions within the Active Directory environment. Attackers can take the captured NetNTLMv2 hash and use tools such as Mimikatz to authenticate directly to other systems that accept NTLM authentication, effectively bypassing multi-factor authentication controls where applicable or exploiting weak password policies on target accounts. This aligns with MITRE ATT&CK technique T1558, specifically Sub-Technique T1558.003 known as Steal or Forge Kerberos Tickets, although in this specific NTLM context it relates more closely to credential harvesting and relay attacks which are categorized under T1557 for Adversary-in-the-Middle scenarios involving LLMNR/NBT-NS poisoning or direct hash capture. The vulnerability also maps to CWE-918, Server-Side Request Forgery (SSRF), as the application acts on user-supplied input by making network requests to an unintended destination based on that input.
Mitigation strategies must focus on both immediate remediation and long-term architectural hardening. The primary defense is to apply the vendor-provided patch or update immediately, which addresses the validation logic in the credential verification module. In environments where patching cannot be applied instantly, network segmentation should be enforced to restrict outbound NTLM authentication traffic from the Devolutions Server host to only known, trusted Active Directory domain controllers via firewall rules. Additionally, organizations should disable LM and NTv1 protocols on all systems if not strictly required by legacy applications, as these are more susceptible to downgrade attacks that facilitate hash capture. Implementing SMB signing for all communications involving sensitive services ensures that even if a request is intercepted or redirected, the integrity of the authentication exchange cannot be manipulated without detection. Furthermore, auditing and restricting the permissions of service accounts used for Active Directory integration reduces the blast radius should such an attack succeed by ensuring these accounts do not hold administrative privileges within the domain.