An authenticated low‑privileged user can exploit a server‑side request forgery flaw in the Active Directory credential validation of Devolutions Server to force the server to query an attacker‑controlled domain name. This behavior allows the attacker to capture the NetNTLMv2 hash of the DVLS service account, providing credential material that can be abused for lateral movement or further attacks. The weakness is a classic CWE‑918 flaw enabling unintended network requests.

Devolutions Server versions 2026.3.12.0 and earlier are affected. The flaw resides in the component that validates AD credentials, which is present in all installations of the Server product that support Active Directory authentication.

The vulnerability can be triggered by a user with basic permissions, making it highly accessible within an organization. The lack of a publicly documented CVSS score or EPSS value limits precise risk quantification, but the ability to harvest NTLM hashes elevates the attack potential. No KEV listing is available, and no official vendor workaround is published, indicating a high urgency for remediation.