Server CVE-2026-4434

Requires WinRM PAM propagation connections configured with TLS certificate verification disabled. Remote network attacker can intercept connections between PAM-enabled systems and WinRM endpoints. No authentication or user interaction needed; AC:H suggests attacker must position themselves on network path.

This vulnerability presents a high real-world risk despite the absence of a CVSS score in the provided data. The attack vector is network-based (AV:N), requires no authentication (AU:N), and does not require user interaction, making it broadly exploitable. The technical impact is severe: compromised WinRM connections can expose plaintext credentials, session tokens, and privileged access tokens used in PAM propagation, directly enabling account takeover and lateral movement. The ENISA EUVD designation (EUVD-2026-13688) indicates this has received formal vulnerability tracking attention. No POC or KEV status is reported in the provided data, suggesting either early disclosure or limited public awareness; however, the simplicity of MITM attacks (requiring only network positioning) means exploitation is highly probable and automatable once the vulnerability is known. Organizations using Devolutions Server for PAM in networked environments face immediate risk of credential compromise. The vulnerability cannot be mitigated through configuration alone—it requires a patched version.

An attacker positioned on the network between a Devolutions Server instance and target Windows systems (e.g., via compromised network infrastructure, ARP spoofing, or DNS hijacking) intercepts WinRM connections initiated by Devolutions Server for PAM credential propagation. Because certificate validation is disabled, the attacker presents a self-signed certificate that is accepted without verification. The attacker then decrypts the WinRM session using the fraudulent certificate, captures plaintext credentials or session tokens, and uses those credentials to assume administrative privileges on the target systems. No proof-of-concept is referenced in the provided data, but the attack requires only network positioning and basic TLS interception tooling, making it straightforward to execute once the vulnerability is identified.