What is the CVSS score of CVE-2026-4434?

CVE-2026-4434 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Server are affected by CVE-2026-4434?

Devolutions Server versions prior to 2026.1 contain a critical certificate validation flaw in PAM propagation that enables network-positioned attackers to intercept and manipulate Windows Remote…. A patch is available.

How to fix or mitigate CVE-2026-4434?

Within 24 hours: Inventory all Devolutions Server instances and identify versions prior to 2026.1; document current version numbers and deployment scope. Within 7 days: Apply vendor-released patch to upgrade all affected Devolutions Server instances to version 2026.1 or later; test upgrades in non-production environments first. Within 30 days: Conduct network segmentation audit to confirm WinRM communications are restricted to trusted administrative networks; implement traffic inspection on all PAM-related communication channels to detect anomalies post-patch.

Server CVE-2026-4434

EUVD-2026-13688 HIGH

Improper Certificate Validation (CWE-295)

2026-03-20 DEVOLUTIONS

Information Disclosure Server

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:19 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1

EUVD ID Assigned

Mar 20, 2026 - 13:45 euvd

EUVD-2026-13688

Analysis Generated

Mar 20, 2026 - 13:45 vuln.today

CVE Published

Mar 20, 2026 - 12:52 nvd

HIGH 8.1

DescriptionCVE.org

Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.

AnalysisAI

Devolutions Server contains an improper certificate validation vulnerability in its PAM propagation WinRM connections that allows network attackers to conduct man-in-the-middle (MITM) attacks by exploiting disabled TLS certificate verification. This vulnerability affects Devolutions Server versions prior to 2026.1, enabling attackers positioned on the network path to intercept and manipulate WinRM communications without detection. The vulnerability is classified under CWE-295 (Improper Certificate Validation) and carries significant information disclosure and server compromise risks, particularly in environments where PAM propagation relies on WinRM for credential delivery and privileged session management.

Technical ContextAI

The vulnerability resides in Devolutions Server's WinRM (Windows Remote Management) integration used for Privileged Access Management (PAM) propagation. WinRM is a Microsoft protocol built on SOAP/HTTP that facilitates remote management and command execution on Windows systems. The root cause, classified as CWE-295 (Improper Certificate Validation), indicates that the application fails to properly validate X.509 TLS certificates during WinRM handshakes. This allows attackers to present self-signed, expired, or forged certificates without triggering validation failures. The affected product is identified via CPE cpe:2.3:a:devolutions:server:*:*:*:*:*:*:*:*, indicating all versions of Devolutions Server prior to 2026.1 are potentially vulnerable. PAM propagation typically involves transmitting sensitive credentials and session tokens across network boundaries; disabling certificate verification completely bypasses the primary mechanism preventing MITM attacks on this sensitive channel.

RemediationAI

Immediately upgrade Devolutions Server to version 2026.1 or later, which includes the certificate validation fix. See the vendor security advisory at https://devolutions.net/security/advisories/DEVO-2026-0005/ for detailed patching instructions and version confirmation. As an interim mitigation pending patch deployment, restrict WinRM traffic from Devolutions Server to trusted internal networks only using network segmentation and firewall rules; disable WinRM PAM propagation if not operationally critical and route privileged session access through alternative mechanisms with enforced TLS certificate validation. Additionally, monitor WinRM connection logs and network traffic for anomalous MITM indicators such as self-signed certificate presentations or unexpected certificate issuer changes. These workarounds reduce attack surface but do not eliminate the underlying vulnerability and should be considered temporary only.