CVE-2026-84850

Executive Summary

CVE-2026-84850 is an improper certificate validation vulnerability (CWE-295) in the shared HTTP client used by the synchronization and integration features of Devolutions Server 2026.2.16 and earlier. Because the client fails to properly validate the certificate presented by a server during outbound TLS connections, a network-positioned attacker who can intercept that traffic can present a spoofed or self-signed certificate, successfully impersonate the legitimate remote endpoint, and read or modify the data exchanged. No public proof-of-concept, exploit code, or Nuclei template exists, EPSS is 0.00093 (0.7th percentile), and no vendor patch is currently available — making compensating network controls the primary defense.

Technical Analysis

The vulnerability class is improper certificate validation (CWE-295), mapped to the broader category of insecure TLS trust handling. In a correctly implemented TLS client, the connecting party verifies that the certificate chain presented by the server terminates in a trusted root CA, that the certificate's subject and Subject Alternative Name (SAN) match the hostname being contacted, and that the certificate is within its validity window and not revoked. CWE-295 covers the case where one or more of these checks is absent or defeatable.

In this CVE, the affected component is explicitly identified as a shared HTTP client used by synchronization and integration features within Devolutions Server. "Shared" is operationally significant: it implies a single TLS/HTTP code path reused across multiple outbound integration flows, so a single validation defect propagates across every feature that relies on that client. The NVD description states the impact as follows: a "network-positioned attacker" can "intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate." Two consequences follow directly from that wording:

1. Interception (confidentiality loss) — the attacker terminates the victim's TLS session with an attacker-controlled key/certificate and can read data the server believed was protected end-to-end.
2. Tampering (integrity loss) — the attacker can modify data returned to (or sent by) the server, which is particularly dangerous for synchronization features that pull configuration, directory, or remote data into Devolutions Server.

The precise defective code path — for example whether the client sets a permissive callback (accept-all), fails to enforce hostname verification, relies on a custom TrustManager/HostnameVerifier equivalent, or disables chain validation in the shared client — is not specified in the NVD description or CNA title provided. Accordingly, no function names, class names, or API parameters can be asserted. What can be stated with confidence is the attack surface: outbound TLS from the Devolutions Server host to remote synchronization/integration endpoints. "Network-positioned" indicates the attacker must be able to observe or redirect that traffic, i.e., share a network path or be able to influence name resolution.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description. No specific endpoints, parameters, or code symbols are invented.

1. Reconnaissance / target identification. The attacker identifies a Devolutions Server instance (version 2026.2.16 or earlier) that performs outbound synchronization or integration connections. Versions can often be inferred from exposed login pages, banners, or passive fingerprinting. The attacker determines the network path between the Devolutions Server host and its remote synchronization/integration destinations and the ports used for outbound HTTP/TLS.

2. Positioning and interception. The attacker gains a network position (adjacent segment, compromised router/AP, malicious upstream proxy, or control of name resolution via DNS spoofing/ARP poisoning/DNS hijacking) such that outbound TLS traffic destined for a legitimate integration endpoint is directed to the attacker.

3. Certificate substitution (triggering the flaw). The attacker presents a spoofed or self-signed certificate for the target hostname. Because the shared HTTP client performs improper certificate validation, the trust/hostname/chain check does not block the connection as it should. The client proceeds to establish a TLS session believing it is talking to the legitimate endpoint. This is the core of the vulnerability: a properly validating client would reject the self-signed certificate.

4. Post-exploitation impact. With the session established, the attacker can (a) read data transiting the "secure" channel and (b) tamper with responses/data, potentially influencing what the synchronization or integration feature imports into Devolutions Server. This maps to CVSS integrity and confidentiality impacts; availability is not described as affected. In a privileged-access-management context, integrity tampering with synchronized/integrated data can undermine trust assumptions in the product's downstream workflows.

Confidence note: The attacker-capability requirements (network positioning) and the outcome (interception and tampering) are directly from the NVD description. The step-by-step mechanics beyond that are a class-level reconstruction and are not corroborated by any published exploit.

Impact Assessment

• Affected product: Devolutions Server 2026.2.16 and earlier. The defect is in a shared component, so the blast radius spans all synchronization and integration features that use the affected HTTP client, not a single feature.
• Confidentiality (High in the assessed vector): Interception of outbound TLS exposes data the server expected to be protected. Devolutions Server is a privileged-access management product, so intercepted integration data may be sensitive.
• Integrity (High in the assessed vector): Tampering with responses can alter data consumed by the server via synchronization/integration, which can have downstream effects on configuration or trust relationships.
• Availability (None/negligible in the assessed vector): The described flaw does not imply denial of service.
• Premise: Exploitation requires a network-positioned attacker (adjacent — AV:A — in the assessed vector) and is complicated by the need to control or intercept the victim's connection path (AC:H). No user interaction is required.
• CVSS disclaimer: The CVSS vector above is an analyst assessment derived solely from the NVD description; the official CVSS score is N/A and no official vector was published.
• Exploitation reality: EPSS 0.00093 (0.7th percentile), no KEV listing, no public PoC, no Nuclei template, no exploit code. Real-world exploitation is not currently evidenced.

Detection Guidance

Detection engineering caveat: because the specific endpoints and internals of the shared HTTP client are not published, the rules below target the observable class-level behavior of a TLS client accepting an untrusted/spoofed certificate and the resulting traffic redirection. Tune to your environment; false positives are possible.

Sigma Rule

title: Possible Outbound TLS Redirect / Untrusted Certificate (Devolutions Server CVE-2026-84850)
id: 3f2a9c1e-8485-4b7c-9e21-devolutions8485
status: experimental
description: Detects signs of an outbound TLS connection from Devolutions Server to an unexpected or untrusted endpoint, consistent with a spoofed/self-signed certificate attack against the shared HTTP client (CWE-295).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-84850
author: valtersit.com
date: 2026/01/01
logsource:
  product: windows
  service: security
detection:
  selection_process:
    Image|endswith:
      - '\\Devolutions.Server.exe'
  selection_net:
    EventID:
      - 5156
      - 3
  selection_tls_error:
    - EventID: 36888   # Schannel: fatal alert generated
    - EventID: 36871   # Schannel: fatal error when creating TLS context
  timeframe: 5m
  condition: selection_process and selection_net and selection_tls_error
falsepositives:
  - Legitimate TLS handshake failures against expiring or misconfigured third-party endpoints
  - Intermittent network path issues causing certificate validation retries
level: medium
tags:
  - attack.t1557
  - cwe.295

YARA Rule

rule CVE_2026_84850_Devolutions_Insecure_TLS_Client
{
    meta:
        description = "Heuristic detection of insecure TLS/certificate-validation handling markers potentially related to CVE-2026-84850 in Devolutions Server components"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-84850"
        cwe = "CWE-295"
        date = "2026-01-01"

    strings:
        $host1 = "Devolutions.Server" ascii wide nocase
        $tls1  = "TrustManager" ascii wide
        $tls2  = "HostnameVerifier" ascii wide
        $tls3  = "ServerCertificateCustomValidationCallback" ascii wide
        $tls4  = "ServicePointManager.ServerCertificateValidationCallback" ascii wide
        $tls5  = "RemoteCertificateValidationCallback" ascii wide
        $bad1  = "acceptAll" ascii wide nocase
        $bad2  = "trustAll" ascii wide nocase
        $bad3  = "ignoreCertificate" ascii wide nocase

    condition:
        $host1 and (2 of ($tls*)) or (1 of ($host1) and 1 of ($bad*))
}

Suricata IDS Rule

alert tls any any -> any any (msg:"CVE-2026-84850 Devolutions Server outbound TLS with self-signed/invalid certificate"; flow:established,to_server; tls.store; tls.cert_subject; \
  content:"Devolutions"; nocase; \
  xbits:set,devserver_tls_flow,track ip_src,expire 300; \
  sid:8485001; rev:1; classtype:attempted-recon; \
  metadata:cve CVE-2026-84850, attack_target Server, cwe CWE-295;)

# Detect TLS flows carrying an untrusted/self-signed issuer on outbound sync paths
alert tls any any -> any any (msg:"CVE-2026-84850 Possible spoofed certificate on Devolutions Server outbound sync"; flow:established,to_server; \
  tls.cert_issuer_cn; \
  content:"self"; nocase; \
  threshold:type both, track by_src, count 1, seconds 60; \
  sid:8485002; rev:1; classtype:attempted-recon; \
  metadata:cve CVE-2026-84850, cwe CWE-295;)

Elastic Detection

sequence by host.name with maxspan=5m
  [ network where process.name : "Devolutions.Server.exe"
      and network.direction : "outbound"
      and network.transport : "tcp" ]
  [ network where process.name : "Devolutions.Server.exe"
      and network.direction : "outbound"
      and tls.server.x509.issuer.common_name != null
      and tls.server.x509.issuer.common_name : "*self*" ]

// Alternative: correlate TLS fatal alerts with outbound connections from the server process
any where process.name : "Devolutions.Server.exe" and
  (event.code : ("36888" or "36871") or event.category : "network")

Splunk SPL Query

index=* (sourcetype=WinEventLog:Security OR sourcetype=stream:tls OR sourcetype=suricata)
(EventCode=5156 OR event_type=tls OR signature_id=8485001 OR signature_id=8485002)
(Image="*\\Devolutions.Server.exe" OR certificate_issuer="*self*" OR cert_subject="*Devolutions*")
| eval suspicious=if(match(Image,"Devolutions.Server") AND match(certificate_issuer,"self"),"SELF_SIGNED", "TLS_EVENT")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_ip) as dest_ips values(certificate_issuer) as issuers by src_ip suspicious
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="devolutions,cve-2026-84850,">
  <rule id="100485" level="10">
    <decoded_as>json</decoded_as>
    <field name="Image">Devolutions.Server.exe</field>
    <field name="event.code">5156</field>
    <description>CVE-2026-84850: Outbound TLS connection initiated by Devolutions Server (possible spoofed-cert MITM)</description>
    <mitre>
      <id>T1557</id>
    </mitre>
  </rule>

  <rule id="100486" level="12">
    <decoded_as>json</decoded_as>
    <field name="EventID">36888</field>
    <description>CVE-2026-84850: TLS fatal alert on Devolutions Server outbound sync (certificate validation anomaly)</description>
    <mitre>
      <id>T1557</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source, and no fixed version is referenced. No vendor workaround is documented.

1. Immediate mitigations (compensating controls)

   • Enforce network segmentation and egress control: restrict outbound TLS connections from Devolutions Server hosts to a defined allowlist of legitimate synchronization/integration destinations (IPs and hostnames). This directly removes the "network-positioned" attacker's ability to redirect traffic.
   • Protect name resolution: use DNSSEC where available, DNSSEC-validating resolvers, and pin internal DNS; monitor for DNS spoofing/hijacking on the segment.
   • Deploy TLS inspection/monitoring on the relevant egress path to detect self-signed or unexpected issuer certificates on outbound connections.
   • If Devolutions Server exposes an option to restrict remote endpoints or disable unused synchronization/integration features, disable unused integrations to shrink the attack surface of the shared client.
   • Monitor the vendor for a fixed release and treat 2026.2.16 and earlier as affected until advisories indicate otherwise.

2. Patch / upgrade steps

   • No fixed version is available as of this report. Subscribe to Devolutions security advisories and upgrade immediately once a patched release is published.
   • Do not assume an interim version fixes the issue without explicit vendor confirmation.

3. Long-term hardening

   • Enforce certificate pinning or strict trust stores for synchronization/integration endpoints where the product permits.
   • Adopt a code/asset review process that treats any "accept-all"/disabled-validation callback in shared HTTP clients as a release blocker (the class of defect behind CWE-295).
   • Maintain outbound egress allowlisting and continuous certificate-transparency monitoring for the integration endpoints in use.

References

1. NVD — CVE-2026-84850: https://nvd.nist.gov/vuln/detail/CVE-2026-84850
2. CWE-295 — Improper Certificate Validation: https://cwe.mitre.org/data/definitions/295.html
3. MITRE ATT&CK T1557 — Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/
4. Devolutions Security Advisories (vendor): https://devolutions.net/security/advisories/
5. CISA Known Exploited Vulnerabilities Catalog (check for CVE-2026-84850 — currently NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploitation note: No threat actor campaigns and no exploit-in-the-wild evidence are associated with CVE-2026-84850 at the time of writing. EPSS is 0.00093 (0.7th percentile), CISA KEV status is NO, and there is no public PoC, exploit code, or Nuclei template. All exploitation analysis in this report is class-level and derived from the NVD description.