CVE-2026-2590 Security feature bypass in Remote Desktop Manager

Critical 9.8 Published 3 Mar 2026 Updated 10 May 2026

Authenticated users can bypass password saving restrictions in Devolutions Remote Desktop Manager, potentially exposing sensitive credentials to other users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-2590?

CVE-2026-2590 is a critical vulnerability in Devolutions Remote Desktop Manager, published on 3 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled.

Weakness: CWE-20, CWE-295

Which versions are affected by CVE-2026-2590?

It affects 1 product.

Products include Devolutions Remote Desktop Manager.

How do I fix CVE-2026-2590?

No fix has been published for CVE-2026-2590 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-2590 being exploited?

There is no known exploitation of CVE-2026-2590 in the wild and no public exploit code.

All Devolutions Remote Desktop Manager vulnerabilities

Sources

Also known as GHSA-pc8p-w57p-fj56.