CVE-2026-4396

Published: Mar 18, 2026Modified: Jun 17, 2026

8.1

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.2 / Impact: 5.9

Source: NVD

Description

Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.

Affected (1)

Products: Devolutions: Hub Reporting Service

Devolutions

1 product

Hub Reporting Service

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Devolutions Hub Reporting Service	Before 2026.1.1.0

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (1)

https://devolutions.net/security/advisories/DEVO-2026-0009/

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.