CVE-2026-120734 in Server
Summary
by MITRE • 11/03/2026
Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in Devolutions Server versions 2026.3.13.0 and prior represents a critical failure in handling sensitive credentials during administrative configuration workflows. Specifically, when an authenticated user attempts to validate or test the server's email settings by specifying a custom SMTP host controlled by an attacker, the system transmits the stored SMTP password in cleartext over the network. This behavior occurs because the application constructs and sends an authentication request to the specified mail server without encrypting the credential payload during this specific testing phase. The flaw is particularly severe because it allows any user with permission to access the email configuration test functionality, which may include lower-privilege administrative accounts or compromised users, to intercept sensitive credentials through network sniffing tools such as Wireshark or tcpdump.
From a technical perspective, this issue stems from an improper implementation of secure communication protocols during credential validation routines. While modern applications are expected to enforce Transport Layer Security (TLS) for all external communications involving authentication data, the test function in Devolutions Server fails to establish an encrypted channel before transmitting the password hash or plaintext credentials required by the SMTP server. This oversight creates a direct pathway for passive network attackers who have access to the same network segment as the Devolutions Server instance. By manipulating the target host parameter within the email configuration interface, an attacker can force the application to reveal its stored secrets in transit, effectively bypassing any intended security controls that rely on encryption at rest or restricted API access.
The operational impact of this vulnerability is significant, particularly for organizations relying on Devolutions Server for secure password management and remote desktop protocol gateway services. The exposure of SMTP credentials allows attackers not only to read sensitive email account passwords but also potentially to impersonate the server in sending malicious emails, thereby facilitating phishing campaigns or malware distribution that appear legitimate due to their origin from a trusted internal system. Furthermore, if these SMTP accounts are reused across other systems or share privileges with higher-level administrative functions, the compromise can lead to broader lateral movement within the enterprise network. This aligns closely with CWE-319, which classifies cleartext transmission of sensitive information as a distinct weakness in software design and implementation.
In terms of threat modeling, this vulnerability maps directly to several techniques within the MITRE ATT&CK framework. It corresponds primarily to T1557, Adversary-in-the-Middle, where an attacker intercepts communications between two parties who believe they are directly communicating with each other. Additionally, it relates to T1048, Exfiltration Over Alternative Protocol, as the sensitive data is exfiltrated via standard email protocols rather than dedicated command-and-control channels. The ability of an authenticated user to trigger this behavior also touches upon privilege escalation vectors if lower-privileged users can exploit this feature to gain access to credentials reserved for higher-level administrators or service accounts.
To mitigate this risk, immediate action should be taken by upgrading Devolutions Server to version 2026.3.14.0 or later, where the vendor has addressed the cleartext transmission issue in the email configuration test module. Until an upgrade is feasible, organizations should restrict network access to the Devolutions Server management interface using strict firewall rules and implement network segmentation to limit exposure to potential sniffing attacks. Additionally, administrators should enforce multi-factor authentication for all accounts with access to system settings and review user permissions to ensure that only highly trusted personnel can modify or test email configurations. Regular monitoring of outbound traffic from the server can also help detect anomalous patterns indicative of credential exfiltration attempts via SMTP protocols.