PT-2026-26149 · Devolutions · Hub Reporting Service

Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-4396

Mitre

CVSS v3.1

8.3

High

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2026-4396

Affected Products

Hub Reporting Service

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-4396 · Security Note
• https://devolutions.net/security/advisories/DEVO-2026-0009 · Note