CVE-2026-2590
CriticalSummary
In Devolutions Remote Desktop Manager 2025.3.30 and earlier, there is improper enforcement of the Disable password saving in vaults setting. This allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users.
Risk Assessment
The organization may be at risk of exposing sensitive credential data, which could lead to unauthorized access to systems and data.
Recommendation
It is recommended to update Devolutions Remote Desktop Manager to the latest version to mitigate this vulnerability and review security settings related to password storage.
Other vulnerabilities in Devolutions Remote Desktop Manager
See all- CVE-2023-4373Critical
Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature.
- CVE-2026-78417Medium
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.
- CVE-2026-13372High
A vulnerability in Devolutions Remote Desktop Manager allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link. The issue affects the custom PowerShell VPN editor in versions 2026.2.5 through 2026.2.11.
- CVE-2026-12162Medium
Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.
- CVE-2023-4417Medium
In Devolutions Remote Desktop Manager version 2023.2.19 and earlier, improper access controls in the entry duplication component allow an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.
Original NVD description (English source)
Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS