CVE-2026-90971

Executive Summary

CVE-2026-90971 is a Server-Side Request Forgery (SSRF) vulnerability in the VMware synchronization feature of Devolutions Server 2026.2.16 and earlier, classified under CWE-863 (Incorrect Authorization). A low-privileged authenticated user can submit a crafted connection definition for datacenter discovery, causing the server to issue requests that expose other users' credentials and reach internal or cloud-metadata network endpoints. The vulnerability is currently unpatched with no public exploit code, but the combination of credential theft and internal network access creates a high-impact post-authentication escalation path for any deployment exposing the VMware synchronization feature.

Technical Analysis

The flaw resides in the VMware synchronization feature's handling of a connection definition submitted for datacenter discovery. Per the NVD description, the server accepts an attacker-influenced connection definition and uses it to initiate outbound requests. Because authorization checks are insufficient (CWE-863), a low-privileged authenticated user is able to redirect these server-side requests to attacker-chosen destinations.

Two distinct impacts are described:

1. Credential exposure — the vulnerable flow allows an attacker to "obtain other users' credentials." This indicates the synchronization code path processes or caches credentials belonging to other accounts and returns or leaks them in a context the low-privileged user can access.
2. SSRF reach — the crafted definition causes the server to query internal services or cloud metadata endpoints, enabling access to resources normally protected by network segmentation.

The underlying mechanism is characteristic of SSRF combined with an authorization defect: the server trusts the connection target embedded in a user-supplied definition rather than enforcing that the user is entitled to reach it, and it does not adequately constrain the destination host or the data returned. No specific function names, class names, URL paths, or parameters are disclosed in the source material, so the code-level execution flow cannot be described with certainty. Attackers do not need any special privilege beyond a valid low-privileged account, and no user interaction is required. The CVSS vector reflects network attack vector, low complexity, low privileges required, no user interaction, changed scope (S:C), and high confidentiality and integrity impact with no availability impact.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class (SSRF + incorrect authorization) and the NVD description.

1. Reconnaissance / Target Identification An attacker first identifies a Devolutions Server instance running 2026.2.16 or earlier and confirms the VMware synchronization feature is enabled and reachable. Because the attacker requires authentication, they either hold a legitimate low-privileged account or have obtained one through phishing or credential stuffing.

2. Triggering the Flaw Using their authenticated session, the attacker navigates to the datacenter discovery functionality within the VMware synchronization feature and submits a crafted connection definition. The definition specifies a destination controlled by the attacker or an internal endpoint. Due to the incorrect authorization check (CWE-863), the server does not validate that the low-privileged user is permitted to define or direct such a connection.

3. Execution Method (Vulnerability-Class Level) The server processes the definition and performs server-side requests to the attacker-specified target. In the credential-theft variant, the response handling exposes other users' credentials to the submitting user. In the SSRF variant, the server is induced to request internal services or the cloud instance metadata endpoint, and the response content is returned to the attacker through the synchronization/discovery interface.

4. Post-Exploitation Impact Successful exploitation yields two high-value outcomes. First, credentials belonging to other Devolutions Server users are disclosed to a low-privileged attacker, enabling lateral account takeover and privilege escalation within the platform. Second, SSRF access to internal or cloud-metadata endpoints can yield environment credentials, internal service data, or a foothold for deeper network intrusion.

Impact Assessment

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) indicates exploitation is network-reachable, low-complexity, requires only low privileges, and needs no user interaction. Scope is changed, meaning the compromised component affects resources beyond its own security authority — consistent with SSRF reaching hosts outside the synchronization feature's intended boundary. Confidentiality and integrity impacts are high; availability is unaffected. Because the primary effect is credential disclosure across users, the blast radius includes every account whose credentials are processed by the affected synchronization path, plus any internal or cloud resource reachable through SSRF. In cloud deployments, metadata endpoint access can translate directly into instance identity compromise. EPSS is 0.00138 (3.5th percentile), indicating no observed mass exploitation at time of writing; CISA KEV status is NO. The lack of a public exploit lowers immediate urgency but does not reduce severity for internet-exposed or cloud-hosted instances.

Detection Guidance

Sigma Rule

title: Potential SSRF via VMware Synchronization Datacenter Discovery in Devolutions Server
id: 7f3c2a91-4b8e-4d2c-9a1e-d5b6c7e8f9a0
status: experimental
description: Detects outbound requests to internal or cloud-metadata endpoints originating from Devolutions Server VMware synchronization datacenter discovery.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-90971
author: valtersit.com
date: 2026/01/01
logsource:
  category: network_connection
  product: windows
detection:
  selection_process:
    Image|endswith: '\\Devolutions.Server.exe'
  selection_dest:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
      - '169.254.0.0/16'
  condition: selection_process and selection_dest
falsepositives:
  - Legitimate VMware synchronization to internal vCenter/vSphere management networks
level: medium

YARA Rule

rule CVE_2026_90971_Devolutions_SSRF_Artifacts
{
    meta:
        author = "valtersit.com"
        description = "Detects connection-definition artifacts associated with VMware synchronization datacenter discovery abuse in Devolutions Server"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-90971"
        date = "2026-01-01"
    strings:
        $vmware = "vmware" ascii nocase
        $sync = "synchronization" ascii nocase
        $datacenter = "datacenter" ascii nocase
        $discovery = "discovery" ascii nocase
        $meta = "169.254.169.254" ascii
    condition:
        uint16(0) == 0x504b or uint32(0) == 0x04034b50 or
        (($vmware and $sync) and ($datacenter or $discovery)) or $meta
}

Suricata IDS Rule

alert http $HOME_NET any -> $HOME_NET any (msg:"CVE-2026-90971 Possible SSRF via Devolutions Server VMware Synchronization Datacenter Discovery"; flow:to_server,established; content:"vmware"; http_uri; nocase; content:"synchroniz"; http_uri; nocase; content:"datacenter"; http_uri; nocase; classtype:attempted-recon; reference:cve,2026-90971; sid:202690971; rev:1;)

Elastic Detection

network where process.name == "Devolutions.Server.exe" and
  (destination.address : "10.0.0.0/8" or
   destination.address : "172.16.0.0/12" or
   destination.address : "192.168.0.0/16" or
   destination.address : "169.254.0.0/16")

Splunk SPL Query

index=proxy OR index=network sourcetype=* 
| search ("vmware" AND ("synchroniz" OR "datacenter" OR "discovery"))
| regex dest_ip="^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)"
| stats count values(dest_ip) as internal_targets by src_ip, user, uri_path
| where count > 0

Wazuh OSSEC Rule

<group name="devolutions,ssrf,">
  <rule id="202690" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">Devolutions.Server.exe</field>
    <regex field="destination.address">^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.)</regex>
    <description>CVE-2026-90971: Devolutions Server possible SSRF to internal/metadata endpoint via VMware synchronization datacenter discovery</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations

• Disable or restrict the VMware synchronization / datacenter discovery feature if not operationally required.
• Restrict low-privileged users from submitting or editing connection definitions used for datacenter discovery.
• Enforce egress filtering and block server-side requests to cloud metadata endpoints (e.g., 169.254.169.254) and internal RFC1918 ranges from the Devolutions Server host.
• Enforce IMDSv2 and least-privilege instance roles in cloud environments to reduce metadata abuse impact.

2. Patch / Upgrade Steps

• No vendor patch is currently available per tracked sources. Monitor Devolutions advisories and update to the first fixed release once published.
• Treat version 2026.2.16 and earlier as affected; verify the deployed version before applying future fixes.

3. Long-Term Hardening

• Implement strict allowlisting/denylisting of destination hosts for any user-supplied connection definition.
• Enforce server-side authorization checks validating entitlement before processing a connection definition (addresses the CWE-863 root cause).
• Segment the Devolutions Server host from sensitive internal networks and management planes.
• Rotate credentials that may have been processed by the affected synchronization path in suspicion of exposure.
• Log and alert on synchronization outbound requests as documented above.

References

• NVD — CVE-2026-90971: https://nvd.nist.gov/vuln/detail/CVE-2026-90971
• MITRE CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — CVE-2026-90971 scoring: https://www.first.org/epss/
• Devolutions vendor advisories (monitor for CVE-2026-90971 patch reference): https://devolutions.net/security/advisories/

No threat actor campaigns or exploit-in-the-wild evidence identified. CISA KEV status: NO. EPSS 0.00138 (3.5th percentile).