CVE-2026-8497
High
Description
Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate.
SeverityHigh
CVSS7.4
Exploit probability—
ProductDevolutions Password Manager
PublishedJul 29, 2026
First seenJul 29, 2026
Weakness typeCWE-295CWE-295
How to fix
Update
- devolutions password_manager2026.2.2.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| devolutions password_manager | v < 2026.2.2.0 | 2026.2.2.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.