Vulnerability Report

CVE-2026-2590

Title: Credential Persistence Bypass in Devolutions Remote Desktop Manager

Other

Proof Of Concept

No public PoC currently indexed for CVE-2026-2590.

CWE Category NVD-CWE-noinfo

Published Date Mar 03, 2026

Modified Date May 10, 2026

Exploit Status Not Found

Score 9.8 CVSS v

Exploit Probability (EPSS)

0.05%

Vulnerability Summary

CVE-2026-2590: Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled.

Impacted Vendors

devolutions 1

Reference Links

https://devolutions.net/security/advisories/DEVO-2026-0005

CVSS v3.1

Source Entity 134c704f-9b21-4f2e-91b3-4a467353bcc0

Severity CRITICAL

9.8

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns