What is the CVSS score of CVE-2026-4396?

CVE-2026-4396 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Hub Reporting Service are affected by CVE-2026-4396?

CVE-2026-4396 presents notable security risk rated CVSS 8.3. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-4396?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

Hub Reporting Service CVE-2026-4396

EUVD-2026-12950 HIGH

Improper Certificate Validation (CWE-295)

2026-03-18 DEVOLUTIONS

Information Disclosure Hub Reporting Service

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 20:00 euvd

EUVD-2026-12950

Analysis Generated

Mar 18, 2026 - 20:00 vuln.today

CVE Published

Mar 18, 2026 - 19:41 nvd

HIGH 8.1

DescriptionCVE.org

Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.

AnalysisAI

Devolutions Hub Reporting Service versions 2025.3.1.1 and earlier contain improper certificate validation that disables TLS certificate verification, enabling network attackers to intercept and manipulate encrypted communications. An unauthenticated attacker on the network can conduct man-in-the-middle (MITM) attacks to eavesdrop on sensitive data exchanges or inject malicious content. While no CVSS score or EPSS probability is currently available, the vulnerability's classification under CWE-295 (Improper Certificate Validation) indicates a cryptographic bypass with potentially severe information disclosure implications.

Technical ContextAI

The vulnerability stems from disabled TLS certificate verification in the Devolutions Hub Reporting Service (CPE: cpe:2.3:a:devolutions:hub_reporting_service:*:*:*:*:*:*:*:*), which is the root cause categorized as CWE-295 (Improper Certificate Validation). TLS certificate validation is a fundamental security control in HTTPS/TLS protocols that ensures clients verify server identity before establishing encrypted channels. When certificate verification is disabled or improperly implemented, the application fails to authenticate the server's identity, allowing attackers positioned on the network path (local network, ISP, cloud provider, etc.) to present their own certificates without triggering validation errors. This is a common misconfiguration in development scenarios that must never reach production.

RemediationAI

Immediately upgrade Devolutions Hub Reporting Service to the patched version released in advisory DEVO-2026-0009 (https://devolutions.net/security/advisories/DEVO-2026-0009/). Until patching is feasible, enforce network-level mitigations: deploy the service only within a trusted, segmented network; implement HTTPS-only policies with HSTS headers at any proxy layer; restrict inbound connections to known, trusted client IP ranges using firewalls or network policies; and monitor for suspicious certificate warnings in application logs. Do not disable certificate verification in any production environment.