{"id":"CVE-2026-120734","aliases":[],"cve":{"records":[{"id":"CVE-2026-120734","source":"DEVOLUTIONS","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-11-02T20:18:42.695Z","published":"2026-11-03T20:37:06.764Z","modified":"2026-11-03T20:37:06.764Z"}],"publishers":[{"name":"DEVOLUTIONS","role":"CNA","organizationId":"bfee16bd-18e6-446c-9a65-f5b2e3d89c23","modified":"2026-11-03T20:37:06.764Z"}],"references":[{"url":"https://devolutions.net/security/advisories/DEVO-2026-0039/","tags":[],"source":"DEVOLUTIONS"}],"weaknesses":[{"id":"CWE-319","description":"CWE-319 Cleartext Transmission of Sensitive Information","source":"DEVOLUTIONS"}],"applicability":[],"prioritization":[]},"title":"Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user…","titleSource":"DEVOLUTIONS","descriptionSource":"DEVOLUTIONS","description":"Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.","score":null,"severity":"unknown","published":"2026-11-03T20:37:06.764Z","modified":"2026-11-03T20:37:06.764Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Devolutions","name":"Server","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"2026.3.13.0","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"DEVOLUTIONS","url":"https://www.cve.org/CVERecord?id=CVE-2026-120734"}],"remediation":[],"references":["https://devolutions.net/security/advisories/DEVO-2026-0039/"],"sources":[{"name":"CVE","id":"CVE-2026-120734","modified":"2026-11-03T20:37:06.764Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-120734"}],"assessments":[],"sourceAffected":[],"observedAt":"2026-11-03T20:45:03.360Z","kev":{"status":"not-listed","checkedAt":"2026-11-05T15:00:33.530Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-03T20:45:32.801Z","attemptedAt":"2026-11-03T20:45:32.801Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-03T20:45:33.019Z","attemptedAt":"2026-11-03T20:45:33.019Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-03T20:45:32.574Z","attemptedAt":"2026-11-03T20:45:32.574Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-03T20:45:33.401Z","attemptedAt":"2026-11-03T20:45:33.401Z"}],"evidence":[],"aiSummary":{"text":"Devolutions Server 2026.3.13.0 and earlier transmits sensitive information in cleartext, allowing an authenticated user to obtain the stored SMTP password. The user must have access to the email configuration test action. The weakness is cleartext transmission of sensitive information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-03T20:46:05.423Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-120734"}]}}