CVE-2026-2590

Published: Mar 3, 2026Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled.

Affected (1)

Products: Devolutions: Remote Desktop Manager

1 product

Remote Desktop Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Devolutions Remote Desktop Manager	Up to 2025.3.30.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (1)

https://devolutions.net/security/advisories/DEVO-2026-0005

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.