This vulnerability, identified as CWE-295, affects Devolutions Server versions up to and including 2026.2.16. It involves improper validation of certificates during LDAPS connections to Active Directory, which could enable a network attacker to perform a man-in-the-middle attack by spoofing a domain controller certificate. This interception could expose privileged credentials used for directory services.

An attacker with network positioning can intercept privileged Active Directory credentials by exploiting the improper certificate validation on LDAPS connections. This could lead to credential compromise and potentially unauthorized access to directory services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, organizations should consider alternative mitigations such as restricting network access to LDAPS services or monitoring for suspicious network activity related to directory service authentication.