CVE-2026-13327

{"id": "CVE-2026-13327", "cveTags": [], "metrics": {}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "Server", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.2.16"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-15T20:17:07.627", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0030/", "source": "security@devolutions.net"}], "vulnStatus": "Received", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Improper certificate validation on LDAPS connections to Active Directory in\u00a0Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate."}], "lastModified": "2026-09-15T20:17:07.627", "sourceIdentifier": "security@devolutions.net"}