Devolutions Password Manager CVE-2026-8497

Exploitation requires the attacker to be on the same adjacent/local network segment as the victim (AV:A) and to be able to intercept and present a forged TLS certificate on the connection between the Password Manager client and its Devolutions Server. Limiting factors: the client must be running one of the affected platforms (Android, iOS, or macOS) at version 2026.2.1.0 or earlier; the attacker needs a MITM position (e.g., rogue AP, ARP/DNS spoofing) rather than remote internet access; the CVSS vector requires low privileges (PR:L) and user interaction (UI:R), meaning the victim must be authenticated/using the app and actively initiate the vulnerable connection for interception to succeed. This is not exploitable by a remote, off-network, unauthenticated attacker.

The CVSS 3.1 vector CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H (7.4, High) captures a realistic but constrained threat: the adjacent (AV:A) attack vector means the attacker must share the local/link-layer network segment rather than exploit remotely across the internet, and exploitation additionally requires low privileges (PR:L) and user interaction (UI:R), which meaningfully raises the bar. Against this, the CIA impact is high across the board because a successful MITM yields total compromise of the intercepted vault traffic - consistent with CISA SSVC rating Technical Impact as 'total.' However, SSVC also rates Exploitation as 'none' and Automatable as 'no,' and there is no KEV listing and no public exploit identified, so real-world urgency is moderate rather than critical. EPSS was not provided in the input and cannot be cited. In short, this is a legitimate confidentiality/integrity risk for users on hostile networks but is not a mass-exploitation, drop-everything issue; the network-adjacency, privilege, and user-interaction requirements make it targeted rather than widespread.

An attacker positioned on the same local network as a target (for example, a rogue access point or ARP-spoofing host on shared Wi-Fi) intercepts the TLS connection a user's Password Manager client makes to its Devolutions Server and presents a forged certificate. Because the client does not properly validate the certificate, the attacker relays and can modify the session, capturing credentials and vault data as the user interacts with the app. No public proof-of-concept is identified at time of analysis, and the attack requires the user to actively use the app on the attacker-controlled network.