Devolutions Server EUVD-2026-102877

Exploitation requires a valid authenticated account with low privileges on the Devolutions Server instance, and the attacker must be able to reach the PingOne groups endpoint and supply an attacker-controlled PingOne configuration value in the request parameter. The target must have a stored PingOne application secret configured (i.e., PingOne integration is set up), so instances without PingOne integration are not exposed. Limiting factors: authentication is required (PR:L), attack complexity is high (AC:H) because the attacker must craft a valid malicious PingOne configuration that the server will act on, and the impact is confined to disclosure of the PingOne application secret (C:L; no integrity or availability impact).

This is a low-severity, low-priority issue despite being network-reachable. The vendor CVSS of 2.6 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) reflects the real picture: exploitation requires an already-authenticated low-privileged account (PR:L), high attack complexity (AC:H) tied to manipulating the PingOne configuration, and yields only limited confidentiality impact (C:L) - disclosure of a single stored PingOne application secret - with no integrity or availability impact. All corroborating signals agree it is low urgency: CISA SSVC rates Exploitation as 'none', Automatable as 'no', and Technical Impact as only 'partial'. No EPSS score was provided in the input, and there is no KEV listing and no public exploit identified, so there is no evidence of exploitation activity. The signals are mutually consistent rather than conflicting - this is a genuine but narrow, low-impact SSRF, not a high-CVSS-but-low-real-risk mismatch nor an under-scored sleeper. Note one minor internal tension worth verifying with the vendor: the CVSS vector sets UI:R (user interaction required), yet the description portrays a self-directed attack in which the authenticated attacker supplies their own PingOne configuration parameter, which would normally imply UI:N; this does not change the overall low-priority conclusion.

An authenticated low-privileged user of a Devolutions Server instance (2026.3.8.0 or earlier) crafts a request to the PingOne groups endpoint supplying an attacker-controlled PingOne configuration in a request parameter. The server performs a server-side request using the stored PingOne application secret, allowing the attacker to redirect that request and exfiltrate the secret. No public exploit identified at time of analysis, and high attack complexity plus the need for a valid account limit practical abuse.