CVE-2026-90971 Overview
CVE-2026-90971 is a Server-Side Request Forgery (SSRF) vulnerability in the VMware synchronization feature of Devolutions Server. The flaw affects Devolutions Server 2026.2.16 and earlier releases. A low-privileged authenticated user can submit a crafted connection definition for datacenter discovery. The server then issues outbound requests to attacker-controlled destinations, exposing other users' credentials and internal or cloud-metadata network endpoints. The Common Weakness Enumeration classifies the underlying issue as [CWE-863] Incorrect Authorization.
Critical Impact
Authenticated attackers can harvest other users' credentials and pivot into internal networks or cloud instance metadata services via forged datacenter discovery requests.
Affected Products
- Devolutions Server 2026.2.16
- Devolutions Server prior releases in the 2026 branch
- Deployments using the VMware synchronization feature
Discovery Timeline
- 2026-09-15 - CVE-2026-90971 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-90971
Vulnerability Analysis
The VMware synchronization feature in Devolutions Server accepts connection definitions from authenticated users to perform datacenter discovery. The server initiates outbound network requests based on the attacker-supplied target without adequately validating the requester's authorization or the destination. This design allows a low-privileged account to coerce the server into acting as a proxy against arbitrary endpoints.
The issue maps to [CWE-863] Incorrect Authorization. The synchronization workflow does not sufficiently distinguish between legitimate VMware endpoints and attacker-controlled hosts. Credentials attached to the sync operation, including those belonging to other users, are transmitted to the destination the attacker specifies.
Root Cause
The root cause is missing authorization and destination validation in the datacenter discovery routine. The server trusts the connection definition submitted by the user and dispatches authenticated requests without verifying that the target represents a legitimate VMware infrastructure endpoint or that the caller is entitled to use the referenced stored credentials.
Attack Vector
An attacker with a valid low-privileged account authenticates to Devolutions Server and creates a VMware synchronization job. The job's connection definition points to an attacker-controlled host or an internal address such as a cloud metadata service endpoint (for example, 169.254.169.254). When the server executes datacenter discovery, it forwards credentials and issues HTTP requests to the specified target. The attacker collects credentials at the listener or retrieves internal service responses relayed by the server. Refer to the Devolutions Security Advisory DEVO-2026-0030 for vendor technical detail.
Detection Methods for CVE-2026-90971
Indicators of Compromise
- Outbound HTTP or HTTPS connections from Devolutions Server hosts to unexpected external addresses originating from the VMware synchronization service.
- Requests from the Devolutions Server host to cloud metadata endpoints such as 169.254.169.254 or internal-only RFC1918 ranges outside the documented VMware infrastructure.
- Newly created VMware sync connection entries authored by low-privileged accounts.
- Authentication events on internal services showing credentials belonging to users other than the sync job's creator.
Detection Strategies
- Baseline the set of legitimate VMware endpoints reachable from Devolutions Server and alert on deviations.
- Correlate Devolutions Server audit logs for new or modified sync jobs against outbound network telemetry.
- Inspect DNS queries from the Devolutions Server host for domains not associated with sanctioned vCenter or ESXi assets.
Monitoring Recommendations
- Forward Devolutions Server application, audit, and web server logs to a centralized analytics platform for retention and correlation.
- Enable network flow logging on the segment hosting Devolutions Server and alert on egress to cloud metadata IPs.
- Review privileged credential usage reports for stored credentials referenced by VMware sync jobs.
How to Mitigate CVE-2026-90971
Immediate Actions Required
- Upgrade Devolutions Server to a fixed release later than 2026.2.16 as identified in Devolutions Security Advisory DEVO-2026-0030.
- Audit existing VMware synchronization jobs and remove any created by accounts that should not manage datacenter discovery.
- Rotate credentials that may have been referenced by sync jobs during the exposure window.
Patch Information
Devolutions has published guidance in Devolutions Security Advisory DEVO-2026-0030. Administrators should apply the fixed version referenced in the advisory. Confirm the deployed build reports a version higher than 2026.2.16 after the upgrade.
Workarounds
- Restrict permission to create or modify VMware synchronization connections to trusted administrators only.
- Place Devolutions Server behind an egress firewall or proxy that allow-lists only sanctioned vCenter and ESXi hostnames.
- Block outbound access from the Devolutions Server host to link-local and cloud metadata addresses such as 169.254.169.254.
- Disable the VMware synchronization feature until the patched version is deployed if it is not in active use.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
