CVE-2026-121580 — Vulnerability intelligence

—

Published: 2026-11-03T21:17:37.710

CVSS

Not available

CISA KEV

Not listed; not proof of no exploitation

Original source text (not a translation)

Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.

Sources

• CVE-2026-121580
• Original advisory