Vulnerability · Published Mar 3, 2026 · Assigned by DEVOLUTIONS
CVE-2026-2590
Critical 9.8
In plain English
A critical-severity improper certificate validation in Remote Desktop Manager from Devolutions. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Official description
Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Devolutions | Remote Desktop Manager | 0 – through 2025.3.30 |
Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H