CVE-2026-4387

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\<username>\.sdm\state.kv. The file is protected only by default user-level NTFS permissions. Exploitation requires local read access to the affected user's profile directory and additional deployment and execution conditions on the target host. The condition was reported through coordinated disclosure by Hope Walker (SpecterOps).

CVSS

No CVSS.

References

Link	Resource
https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed
https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/

Configurations

No configuration.

History

22 Jul 2026, 06:10

Type	Values Removed	Values Added
Summary		(es) La aplicación de escritorio StrongDM anterior a la versión 23.74.0 (Cliente de escritorio anterior a la versión 53.77.0) en Microsoft Windows almacena el estado de autenticación, incluyendo un JSON Web Token y material de clave asimétrica, en texto claro en un archivo de estado por usuario ubicado en C:\Users\<username>\.sdm\state.kv. El archivo está protegido únicamente por permisos NTFS predeterminados a nivel de usuario. La explotación requiere acceso de lectura local al directorio de perfil del usuario afectado y condiciones adicionales de despliegue y ejecución en el host objetivo. La condición fue reportada a través de una divulgación coordinada por Hope Walker (SpecterOps).

01 Jun 2026, 17:17

Type	Values Removed	Values Added
References		() https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/ -

29 May 2026, 20:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-05-29 20:16

Updated : 2026-07-22 06:10

NVD link : CVE-2026-4387

Mitre link : CVE-2026-4387

CVE.ORG link : CVE-2026-4387

JSON object : View

Products Affected

No product.

CWE

CWE-312

Cleartext Storage of Sensitive Information

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-4387", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-4387", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T19:49:18.108657Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "ebf2cdfb-f390-4894-8ec9-f81bf1c57e6b", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.0, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ebf2cdfb-f390-4894-8ec9-f81bf1c57e6b", "affectedData": [{"vendor": "StrongDM", "product": "StrongDM Desktop Application", "versions": [{"status": "affected", "version": "0", "lessThan": "23.74.0", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}, {"vendor": "StrongDM", "product": "StrongDM Desktop Client", "versions": [{"status": "affected", "version": "0", "lessThan": "53.77.0", "versionType": "semver"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}]}], "published": "2026-05-29T20:16:30.650", "references": [{"url": "https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2ed", "source": "ebf2cdfb-f390-4894-8ec9-f81bf1c57e6b"}, {"url": "https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/", "source": "ebf2cdfb-f390-4894-8ec9-f81bf1c57e6b"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "ebf2cdfb-f390-4894-8ec9-f81bf1c57e6b", "description": [{"lang": "en", "value": "CWE-312"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\\Users\\<username>\\.sdm\\state.kv. The file is protected only by default user-level NTFS permissions.\n\n\n\nExploitation requires local read access to the affected user's profile directory and additional deployment and execution conditions on the target host.\n\n\n\nThe condition was reported through coordinated disclosure by Hope Walker (SpecterOps)."}, {"lang": "es", "value": "La aplicaci\u00f3n de escritorio StrongDM anterior a la versi\u00f3n 23.74.0 (Cliente de escritorio anterior a la versi\u00f3n 53.77.0) en Microsoft Windows almacena el estado de autenticaci\u00f3n, incluyendo un JSON Web Token y material de clave asim\u00e9trica, en texto claro en un archivo de estado por usuario ubicado en C:\\Users\\<username>\\.sdm\\state.kv. El archivo est\u00e1 protegido \u00fanicamente por permisos NTFS predeterminados a nivel de usuario.\n\nLa explotaci\u00f3n requiere acceso de lectura local al directorio de perfil del usuario afectado y condiciones adicionales de despliegue y ejecuci\u00f3n en el host objetivo.\n\nLa condici\u00f3n fue reportada a trav\u00e9s de una divulgaci\u00f3n coordinada por Hope Walker (SpecterOps)."}], "lastModified": "2026-07-22T06:10:00.170", "sourceIdentifier": "ebf2cdfb-f390-4894-8ec9-f81bf1c57e6b"}