Vulnerability in Devolutions Hub Reporting Service

CVE-2026-4396

Improper certificate validation in Devolutions Hub Reporting Service 2025.3.1.1 and earlier allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification.

Vulnerability class: Improper Certificate Validation

EPSS: 0.000 (15.0th percentile) — read the EPSS interpretation.