PT-2026-22827 · Devolutions · Devolutions Remote Desktop Manager

Published 2026-03-03 · Updated 2026-05-10 · CVE-2026-2590

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Devolutions Remote Desktop Manager versions 2025.3.30 and earlier

Description An issue exists in the connection entry component of the software where the 'Disable password saving in vaults' setting is not properly enforced. This allows an authenticated user to persist credentials in vault entries when password saving is disabled. This could potentially expose sensitive information to other users by creating or editing specific connection types.

Recommendations Versions prior to 2025.3.30 should be updated.

Fix

RCE

Improper Certificate Validation

Weakness Enumeration

CWE-20

CWE-295

Related Identifiers

CVE-2026-2590

Affected Products

Devolutions Remote Desktop Manager

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-2590 · Security Note
• https://osv.dev/vulnerability/CVE-2026-2590 · Vendor Advisory
• https://devolutions.net/security/advisories/DEVO-2026-0005 · Vendor Advisory
• https://t.me/CVEtracker/46246 · Telegram Post
• https://t.me/cveNotify/162931 · Telegram Post
• https://twitter.com/CVEnew/status/2028959729716695400 · Twitter Post
• https://t.me/cveNotify/154123 · Telegram Post
• https://twitter.com/infoflowcloud/status/2028961501529211241 · Twitter Post
• https://t.me/cveNotify/154340 · Telegram Post
• https://twitter.com/TheHackerWire/status/2029230453476184247 · Twitter Post