CVE-2026-4387Unencrypted storage of authentication state in StrongDM Desktop Application state.kv file
Updated under an hour ago ()
Does this affect you?
It affects StrongDM Desktop Application and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\<username>\.sdm\state.kv. The file is protected only by default user-level NTFS permissions. Exploitation requires local read access to the affected user's profile directory and additional deployment and execution conditions on the target host. The condition was reported through coordinated disclosure by Hope Walker (SpecterOps).
- CVSS
- 2.0 LOW (v4.0, CNA)CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:L
- Weakness (CWE)
- CWE-312, CWE-522
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- StrongDM
- NVD analysis
- Awaiting Analysis
- Record last updated
- Jun 1, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
StrongDM StrongDM Desktop Application strongdm:desktop_application (from the name) | before 23.74.0 | CNA record |
StrongDM StrongDM Desktop Client strongdm:desktop_client (from the name) | before 53.77.0 | CNA record |
References
- https://security.strongdm.com/?tcuUid=56fde839-9388-4361-8d3b-9baa7b2de2edvendor-advisory
- https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/related
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.