CVE-2026-90971

{"id": "CVE-2026-90971", "cveTags": [], "metrics": {}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.2.16"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-15T19:17:47.170", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0030/", "source": "security@devolutions.net"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) in the VMware synchronization feature in\u00a0Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery."}], "lastModified": "2026-09-15T19:17:47.170", "sourceIdentifier": "security@devolutions.net"}