CVE-2026-0747

In Devolutions Remote Desktop Manager 2025.3.30 and earlier, there is improper enforcement of the Disable password saving in vaults setting. This allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users.

Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 and earlier permits a user to initiate a connection without proper execution rights via the remote tools feature.

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.

A vulnerability in Devolutions Remote Desktop Manager allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link. The issue affects the custom PowerShell VPN editor in versions 2026.2.5 through 2026.2.11.

Improper host validation in the social login autofill feature in Devolutions Remote Desktop Manager 2026.2.8 allows an attacker to disclose stored social login credentials via a crafted web entry pointing to a provider lookalike domain.

In Devolutions Remote Desktop Manager version 2023.2.19 and earlier, improper access controls in the entry duplication component allow an authenticated user, under specific circumstances, to inadvertently share their personal vault entry with shared vaults via an incorrect vault in the duplication write process.