CVE-2026-4387Disclosure

LOWCVSS 2.0 · LOW

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric key material, in cleartext in a per-user state file located at C:\Users\<username>\.sdm\state.kv. The file is protected only by default user-level NTFS permissions. Exploitation requires local read access to the affected user's profile directory and additional deployment and execution conditions on the target host. The condition was reported through coordinated disclosure by Hope Walker (SpecterOps).

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-312CWE-522

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
9 mentions across 5 observed days
Momentum state: stable

What's happening

Active exploitation reported across 2 signals
Technical details provided in 7 signals
Disclosure: 6 classified signals
Patch: 1 classified signal
Peaked 3d ago at 3 mentions (2026-06-01); latest day: 1
9 total mentions across 5 days

Deep dive

Activity timeline9 mentions / 5d

Signal classification3 categories

Disclosure

666.7%

Active Exploitation

222.2%

Patch

111.1%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-29	1	Disclosure1
2026-06-01	3	Disclosure3
2026-06-02	3	Active Exploitation2Disclosure1
2026-06-06	1	Disclosure1
2026-06-09	1	Patch1

Full discourse9 posts

SpecterOps@SpecterOps134d
Disclosure
During an assessment, our team discovered that StrongDM auth state files containing JWTs & key material could be reused across hosts to obtain authenticated sessions & access infrastructure resources (CVE-2026-4387). Read more from @icemoonhsv ⤵️ https://ghst.ly/4egbgVd
Post summary
The post reports a discovery that StrongDM auth state files can be reused to forge authenticated sessions, but it lacks PoC, exploit code, or patch details.
0401533.1K
41.0K followersView on X
Hope Walker@Icemoonhsv134d
Disclosure
I'm excited to be able to finally publish the public disclosure for CVE-2026-4387. Check out my blog on discovering the reuse of the state.kv file to get authenticated sessions with StrongDM (now fixed). https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/
Post summary
The author publicly discloses CVE-2026-4387, detailing how the state.kv file can be reused to hijack authenticated StrongDM sessions and notes that the vulnerability has been fixed.
0301201.8K
1.2K followersView on X
DFIR Radar@DFIR_Radar134d
Disclosure
CVE-2026-4387: Critical StrongDM flaw allowed attackers to steal and reuse authentication state files across hosts for persistent access. Plaintext JWT and key pairs in user directories enabled session hijacking without credential theft. Key technical details: • Vulnerable path: C:\Users\<username>\.sdm\state.kv contained JWT + RSA key pairs in plaintext • Attack vector: Copy state.kv between hosts, replace victim's file, gain authenticated access to infrastructure • Required permissions: User-level access only (no admin rights needed) • Affected versions: All prior to Desktop 23.74.0 and CLI 53.77.0 • Local endpoint http://127.0.0.1:65220/v2/authentication leaked JWTs with simple no-cors header Attack methodology: • Exfiltrate state.kv from authenticated user's workstation • Deploy on attacker-controlled host with StrongDM installed • Replace local state file after application launch for higher success rate • Automatic session refresh provides full access to victim's StrongDM resources DFIR artifacts: • Monitor file access to .sdm\state.kv via Process Monitor or Sysmon Event ID 11 • Check for unusual StrongDM CLI connections from non-standard hosts/IPs • Audit authentication logs for sessions from unexpected geographic locations Hunt for recent state.kv file modifications and cross-reference with StrongDM process execution outside normal user patterns. #DFIR_Radar
Post summary
The post discloses technical details of CVE‑2026‑4387, explaining how attackers can hijack StrongDM sessions via plaintext state files and how to detect such incidents.
10011261
1.6K followersView on X
iototsecnews@iototsecnews126d
Patch
StrongDM の脆弱性 CVE-2026-4387 が FIX：認証情報の窃取と不正アクセスの恐れ https://iototsecnews.jp/2026/06/02/critical-strongdm-vulnerability-allows-attackers-to-steal-and-reuse-authentication/ 今回の StrongDM における脆弱性 CVE-2026-4387 は、認証情報の保存方法に主な原因がありました。本来であれば厳重に守られるべきセッション・データが、ローカル環境内に平文の状態で保存されていたことが問題視されています。具体的には、ログイン時に生成される大切なトークンや鍵のペアが、特別な権限を持たないユーザーでも読み取れる状態でディスクに記録されていました。また、認証情報が特定の端末に紐付けられていなかったため、別のコンピュータへコピーするだけで簡単に再利用できてしまう仕組みになっていたことも被害を広げる要因です。ご利用のチームは、ご注意ください。 #CVE20264387 #StrongDM #Vulnerability
Post summary
The article reports that StrongDM’s CVE-2026‑4387 has been fixed and warns teams about the risk of credential theft from plain‑text storage, though no patch details or active exploitation are disclosed.
01000133
495 followersView on X
David Koepi@davidkoepi129d
Disclosure
[SpecterOps] CVE-2026-4387: StrongDM State File Reuse https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/
Post summary
The text announces the CVE-2026-4387 vulnerability but offers no further technical details or actionable information.
0000045
328 followersView on X
ThreatCluster@threatcluster133d
Disclosure
BREAKING: Critical StrongDM vuln CVE-2026-4387 lets attackers steal and reuse auth tokens in desktop and CLI before 23.74.0 and 53.77.0, risking enterprise infrastructure access. https://threatcluster.io/cluster/critical-strongdm-vulnerability-enables-authentication-token-f1fe1d87
Post summary
A critical StrongDM vulnerability (CVE-2026-4387) that allows attackers to steal and reuse authentication tokens has been announced. The flaw affects desktop and CLI versions prior to 23.74.0 and 53.77.0 and could compromise enterprise infrastructure access.
0000085
294 followersView on X
ThreadLinqs@threadlinqs133d
Active Exploitation
NEW THREAT INTEL: StrongDM Desktop plaintext session keys (CVE-2026-4387) allow credential-less session hijack. 9 detections. https://intel.threadlinqs.com/threat/TL-2026-0654 #ThreatIntel #InfoSec https://t.co/5cD8M3K79m
Post summary
StrongDM Desktop’s plaintext session keys in CVE‑2026‑4387 are actively exploited for credential‑less session hijacking, with nine detections reported in the threat intel.
0000059
54 followersView on X
ThreadLinqs@threadlinqs133d
Active Exploitation
NEW THREAT INTEL: StrongDM CVE-2026-4387 - cleartext state.kv = credential-less session hijack. 9 detections, 13 IOCs. https://intel.threadlinqs.com/threat/TL-2026-0654 #ThreatIntel #StrongDM https://t.co/UDmCO9vhNT
Post summary
The intel points to StrongDM CVE‑2026‑4387 being actively abused, with 9 detections and evidence of credential‑less session hijack via cleartext state.kv, but no PoC, patch or exploit tool details are provided.
0000061
54 followersView on X
CVE@CVEnew137d
Disclosure
CVE-2026-4387 StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric … https://www.cve.org/CVERecord?id=CVE-2026-4387
Post summary
The text references CVE-2026-4387 and notes that the StrongDM Desktop application stores authentication state, but it does not include a PoC, exploit, patch, or detailed technical description.
00000172
57.5K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-4387

DFIR Radar[verified]@DFIR_RadarDisclosure

The post discloses technical details of CVE‑2026‑4387, explaining how attackers can hijack StrongDM sessions via plaintext state files and how to detect such incidents.

ThreatCluster[verified]@threatclusterDisclosure

A critical StrongDM vulnerability (CVE-2026-4387) that allows attackers to steal and reuse authentication tokens has been announced. The flaw affects desktop and CLI versions prior to 23.74.0 and 53.77.0 and could compromise enterprise infrastructure access.

ThreadLinqs[verified]@threadlinqsActive Exploitation

StrongDM Desktop’s plaintext session keys in CVE‑2026‑4387 are actively exploited for credential‑less session hijacking, with nine detections reported in the threat intel.

ThreadLinqs[verified]@threadlinqsActive Exploitation

The intel points to StrongDM CVE‑2026‑4387 being actively abused, with 9 detections and evidence of credential‑less session hijack via cleartext state.kv, but no PoC, patch or exploit tool details are provided.

SpecterOps@SpecterOpsDisclosure

The post reports a discovery that StrongDM auth state files can be reused to forge authenticated sessions, but it lacks PoC, exploit code, or patch details.

Hope Walker@IcemoonhsvDisclosure

The author publicly discloses CVE-2026-4387, detailing how the state.kv file can be reused to hijack authenticated StrongDM sessions and notes that the vulnerability has been fixed.

iototsecnews@iototsecnewsPatch

The article reports that StrongDM’s CVE-2026‑4387 has been fixed and warns teams about the risk of credential theft from plain‑text storage, though no patch details or active exploitation are disclosed.

David Koepi@davidkoepiDisclosure

The text announces the CVE-2026-4387 vulnerability but offers no further technical details or actionable information.