EUVD-2026-50422
GHSA-8v79-5vwg-m22q
Severity by source
AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Adjacent MITM (AV:A) needing an authenticated user actively connecting (PR:L, UI:R); forged-cert interception yields full read/modify of vault traffic, so C/I/A all High.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate.
AnalysisAI
Man-in-the-middle interception in Devolutions Password Manager (version 2026.2.1.0 and earlier on Android, iOS, and macOS) stems from improper TLS certificate validation when the mobile/desktop client connects to a Devolutions Server. An adjacent-network attacker presenting a forged certificate can silently intercept and modify the sensitive vault/session traffic between client and server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to be on the same adjacent/local network segment as the victim (AV:A) and to be able to intercept and present a forged TLS certificate on the connection between the Password Manager client and its Devolutions Server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (7.4, High) captures a realistic but constrained threat: the adjacent (AV:A) attack vector means the attacker must share the local/link-layer network segment rather than exploit remotely across the internet, and exploitation additionally requires low privileges (PR:L) and user interaction (UI:R), which meaningfully raises the bar. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker positioned on the same local network as a target (for example, a rogue access point or ARP-spoofing host on shared Wi-Fi) intercepts the TLS connection a user's Password Manager client makes to its Devolutions Server and presents a forged certificate. Because the client does not properly validate the certificate, the attacker relays and can modify the session, capturing credentials and vault data as the user interacts with the app. … |
| Remediation | Vendor-released patch: upgrade Devolutions Password Manager to version 2026.2.2 or later on all affected Android, iOS, and macOS devices, per the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0027/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Devolutions Password Manager deployments across iOS, Android, and macOS systems, notify affected users of the vulnerability, and review network access logs from the past 90 days for suspicious activity correlated with password manager connections. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Password Manager
View allThe HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url para
A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker
One Identity Password Manager before 5.13.1 allows Kiosk Escape. Rated critical severity (CVSS 9.8), this vulnerability
HTML injection vulnerability in Enpass Password Manager Desktop Client 6.9.2 for Windows and Linux allows attackers to r
One Identity Password Manager before 5.13.1 allows Kiosk Escape. Rated high severity (CVSS 8.8), this vulnerability is r
Trend Micro Password Manager (Consumer) version 5.0.0.1217 and below is vulnerable to an Exposed Hazardous Function Remo
Uniqkey Password Manager 1.14 contains a vulnerability because it fails to recognize the difference between domains and
Trend Micro Password Manager (Consumer) versions 5.8.0.1327 and below contains a privilege escalation vulnerability expl
EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend M
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalat
Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search P
A component in Kaspersky Password Manager could allow an attacker to elevate a process Integrity level from Medium to Hi
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today