Improper Certificate Validation in PAM Propagation via WinRM Connections by Devolutions
CVE-2026-4434

8.1HIGH

Key Information:

Vendor

Devolutions

Status
Server
Vendor
CVE Published:
20 March 2026

What is CVE-2026-4434?

The vulnerability involves improper certificate validation in the PAM propagation through WinRM connections. This flaw could allow an attacker to execute a man-in-the-middle attack by exploiting disabled TLS certificate verification. Such security oversight may lead to unauthorized access and data breaches, compromising sensitive information and network integrity.

Affected Version(s)

Server 0 < 2026.1

References

https://devolutions.net/security/advisories/DEVO-2026-0005/

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.