Server-Side Request Forgery

Every one of the 5 is a mark on the map. Named now: 1 to 5, most at risk first.

1. Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira…CVE-2026-121580Devolutions · CVSS 8.1 · 0.3% likely

   CWE-918

2. Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the…CVE-2026-120715Devolutions · CVSS 8.1 · 0.2% likely

   CWE-918

3. Improper authorization in the Active Directory browsing feature in Devolutions Server allows a low-privileged authenticated user to obtain authentication material associated with…CVE-2026-7325Devolutions · CVSS 7.1 · 0.2% likely

   CWE-918

4. Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), poten…CVE-2026-4989Devolutions · CVSS 4.3 · 0.2% likely

   CWE-918

5. Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an authenticated low-privileged user to exfiltrate the stored PingOne ap…CVE-2026-110805Devolutions · CVSS 2.6 · 0.1% likely

   CWE-918

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.