CVE-2026-78417
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.
Risk Assessment
Attackers can intercept and modify VNC session data, potentially leading to data theft or unauthorized access.
Recommendation
Update Remote Desktop Manager to the latest version and manually verify server RSA keys.
Other vulnerabilities in Devolutions Remote Desktop Manager
See all- CVE-2026-2590Critical
In Devolutions Remote Desktop Manager 2025.3.30 and earlier, there is improper enforcement of the Disable password saving in vaults setting. This allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users.
- CVE-2023-4373Critical
Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature.
- CVE-2026-13372High
A vulnerability in Devolutions Remote Desktop Manager allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link. The issue affects the custom PowerShell VPN editor in versions 2026.2.5 through 2026.2.11.
- CVE-2026-12162Medium
Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.
- CVE-2023-4417Medium
In Devolutions Remote Desktop Manager version 2023.2.19 and earlier, improper access controls in the entry duplication component allow an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.
Original NVD description (English source)
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.