PT-2026-44973 · Strongdm+1 · Strongdm Desktop Application+2

Hope Walker · Published 2026-05-29 · Updated 2026-06-02 · CVE-2026-4387

Positive Technologies (AI Summary)

CVSS v4.0

2.0

Low

Base vector

AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions StrongDM Desktop Application versions prior to 23.74.0 StrongDM Desktop Client versions prior to 53.77.0

Description On Microsoft Windows, the software stores authentication state in cleartext within a per-user state file located at "C:Users.sdmstate.kv". This file contains a JSON Web Token (JWT) and asymmetric RSA key material, protected only by default user-level NTFS permissions. An attacker with local read access to the user's profile directory can exfiltrate this file and deploy it on another host to hijack sessions and gain authenticated access to infrastructure resources without needing credentials. Additionally, the local endpoint "http://127.0.0.1:65220/v2/authentication" leaked JWTs.

Recommendations Update StrongDM Desktop Application to version 23.74.0 or later. Update StrongDM Desktop Client to version 53.77.0 or later.

Fix

Cleartext Storage of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-312

CWE-522

Related Identifiers

CVE-2026-4387

Affected Products

Strongdm Desktop Application

Strongdm Desktop Client

Windows

References · 13

• https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4387 · Security Note
• https://twitter.com/threatcluster/status/2061747286628028581 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1tu0gn9/secopsdaily_20260601_roundup · Reddit Post
• https://twitter.com/DFIR_Radar/status/2061493777550758318 · Twitter Post
• https://twitter.com/Icemoonhsv/status/2061494596345983315 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1ttwwdj/cve20264387_strongdm_state_file_reuse · Reddit Post
• https://twitter.com/threadlinqs/status/2061740337144398015 · Twitter Post
• https://twitter.com/CVEnew/status/2060470664373350418 · Twitter Post
• https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse · Note
• https://t.me/CVEtracker/55314 · Telegram Post
• https://twitter.com/threadlinqs/status/2061740714258509991 · Twitter Post
• https://twitter.com/SpecterOps/status/2061505576786424307 · Twitter Post