Improper validation of TLS certificates in Devolutions Server’s PAM WinRM connections allows an attacker to intercept network traffic and alter data. The vulnerability, identified as CWE‑295, disables certificate verification, enabling a man‑in‑the‑middle attack that compromises confidentiality and integrity of communication between the server and its clients.

Devolutions:Server is the affected product. No specific version information is provided in the CVE data, so any deployed instance of Devolutions Server may be vulnerable until a patch is applied.

The CVSS score of 8.1 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely attack vector is a network adversary capable of intercepting or forging WinRM traffic where certificate verification is disabled.