Devolutions Remote Desktop Manager vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Devolutions Remote Desktop Manager: 7 record(s), with affected versions and fixes.cpe:2.3:a:devolutions:remote_desktop_manager
CVE-2026-78417
Medium · 4.3
CWE-345 Aug 24, 2026
Insufficient Verification of Data Authenticity in Devolutions Remote Desktop Manager
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.
CVE-2026-13372
High · 7.2
CWE-706 Jun 26, 2026
Use of Incorrectly-Resolved Name or Reference in Devolutions Remote Desktop Manager
Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link.
CVE-2026-12162
Medium · 5.5
CWE-297 Jun 15, 2026
Improper host validation in the social login autofill feature in Devolutions Remote…
Improper host validation in the social login autofill feature in
Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to
disclose stored social login credentials via a crafted web entry
pointing to a provider lookalike domain.
CVE-2026-12161
High · 8.8
CWE-78 Jun 15, 2026
OS Command Injection in Devolutions Remote Desktop Manager
Improper input validation in the SSH Elevate Shell feature allows an authenticated user
with permission to create or modify a shared SSH entry to execute
arbitrary commands on a remote SSH host using stored elevation
credentials via a crafted alternate username and user interaction with
the Elevate Shell action.
This affects :
- Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0
- Remote Desktop Manager 2026.1.23.0 and earlier
CVE-2026-2590
Critical · 9.8
CWE-20 Mar 3, 2026
Improper Input Validation in Devolutions Remote Desktop Manager
Improper
enforcement of the Disable password saving in vaults setting in the
connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries,
potentially exposing sensitive information to other users, by creating
or editing certain connection types while password saving is disabled.
CVE-2026-0747
Low · 3.3
CWE-200 Jan 8, 2026
Exposure of Sensitive Information in Devolutions Remote Desktop Manager
Exposure of sensitive information in the TeamViewer entry dashboard component in Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows allows an external observer to view a password on screen via a defective masking feature, for example during physical observation or screen sharing.
CVE-2025-13683
Medium · 6.5
CWE-200 Nov 28, 2025
Exposure of Sensitive Information in Devolutions Devolutions Server
Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8.0; Remote Desktop Manager: through 2025.3.23.0.