Platform
windows
Component
pam-propagation-winrm-connections
Fixed in
2026.1
CVE-2026-4434 describes an improper certificate validation vulnerability within the PAM propagation WinRM connections feature. This flaw allows a network attacker to conduct a man-in-the-middle (MITM) attack by exploiting disabled TLS certificate verification. The vulnerability impacts versions 0 through 2026.1 and has been resolved in version 2026.1.
The core impact of CVE-2026-4434 lies in the potential for a network-based MITM attack. An attacker positioned between a client and the server can intercept and potentially modify WinRM traffic without detection. This could lead to unauthorized access, data exfiltration, or even the execution of malicious commands on the target system. The lack of proper certificate validation means the client will accept a forged certificate, effectively bypassing security controls. This is particularly concerning in environments where WinRM is used for remote management or automation, as an attacker could gain control of critical systems.
CVE-2026-4434 was publicly disclosed on March 20, 2026. The EPSS score is pending evaluation. No public proof-of-concept (PoC) exploits are currently known. It is not listed on the CISA KEV catalog at the time of this writing.
Exploit Status
EPSS
0.03% (7% percentile)
The primary mitigation for CVE-2026-4434 is to upgrade to version 2026.1 or later, which includes improved TLS certificate verification. If upgrading is not immediately feasible, consider implementing stricter network segmentation to limit potential attacker access. Review WinRM configurations to ensure TLS is enforced and certificate pinning is enabled where possible. Monitor WinRM traffic for suspicious activity and consider implementing a Web Application Firewall (WAF) to filter malicious requests. While a direct detection signature is difficult without specific IOCs, monitor for unusual certificate chains or unexpected WinRM connections.
Update Devolutions Server to version 2026.1 or later. This corrects the improper certificate validation and prevents man-in-the-middle attacks. The update will disable TLS certificate verification.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-4434 is a vulnerability in PAM propagation WinRM connections that allows a network attacker to perform a man-in-the-middle attack due to improper certificate validation.
If you are using PAM propagation WinRM connections in versions 0 through 2026.1, you are potentially affected by this vulnerability.
Upgrade to version 2026.1 or later to resolve the vulnerability. If upgrading is not possible, implement stricter network segmentation and review WinRM configurations.
As of the current assessment, there are no confirmed reports of active exploitation of CVE-2026-4434.
Refer to the official PAM documentation and security advisories for detailed information and updates regarding CVE-2026-4434.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.