CVE-2026-84850

MediumCVSS 4.8/10Last modified Sep 20, 2026

Description

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-295

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Sep 20, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-848517.5An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion daCVE-2026-848524.4A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNewCVE-2026-848547.0In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer couCVE-2026-848565.3A vulnerability was detected in rowboatlabs rowboat up to 0.9.1. The impacted element is the function request.text/req.json of the file appsCVE-2026-848575.3A flaw has been found in sigoden aichat up to 0.30.4. This affects an unknown function of the file src/serve.rs of the component API EndpoinCVE-2026-848588.8ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataCVE-2026-848596.5ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSCVE-2026-84867.5Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding. This issue affecCVE-2026-848608.8ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, CVE-2026-848627.2IBM Guardium Data Protection 12.2 is vulnerable to insecure deserialization in the Quartz JDBC job store. An authenticated attacker could exCVE-2026-848699.9A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorizatioCVE-2026-84877.5Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affe