MajorCritical vulnerability

CVE-2026-13327 (CVSS 8.3)

NVD · officialPublished Sep 15, 2026Risk 37/100EPSS 0.1%

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate.

Technical details

CVSS

8.3

AV:Adjacent NetworkAC:HighPR:NoneUI:NoneC:HighI:HighA:High

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source