CVE-2026-4396: High severity Devolutions Hub Reporting Service vulnerability
Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4396?
CVE-2026-4396 has a high severity rating due to its potential for leading to man-in-the-middle attacks.
How do I fix CVE-2026-4396?
To fix CVE-2026-4396, upgrade to Devolutions Hub Reporting Service version 2025.3.1.2 or later to enable TLS certificate verification.
What are the risks associated with CVE-2026-4396?
The risks associated with CVE-2026-4396 include unauthorized interception of sensitive data by a network attacker.
Which versions of Devolutions Hub Reporting Service are affected by CVE-2026-4396?
CVE-2026-4396 affects Devolutions Hub Reporting Service versions up to and including 2025.3.1.1.
Is there a way to mitigate CVE-2026-4396 without upgrading?
Temporary mitigation strategies for CVE-2026-4396 include manually enabling TLS certificate verification in configurations if possible.