CVE-2026-4989 — Devolutions / Server

CVE-2026-4989

Devolutions / Server PUBLISHED

Description (CNA)

Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (SSRF), potentially leading to information disclosure, via a crafted API request. This issue affects Server: from 2026.1.1 through 2026.1.11, from 2025.3.1 through 2025.3.17.

Affected (CNA)

Vendor / product	Versions
Devolutions / Server	affected 2026.1.1 through 2026.1.11; affected 2025.3.1 through 2025.3.17

CWE

CWE-918

References

https://devolutions.net/security/advisories/DEVO-2026-0010

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.