CVE-2026-2590 in Remote Desktop Manager
Summary
by MITRE • 03/04/2026
Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/06/2026
This vulnerability exists within Devolutions Remote Desktop Manager version 2025.3.30 and earlier, specifically targeting the connection entry component's handling of password saving restrictions. The flaw represents a critical breakdown in access control mechanisms that should prevent credential persistence when users explicitly disable password saving in vaults. The vulnerability stems from insufficient validation of the Disable password saving setting during connection entry creation or modification processes, allowing authenticated users to bypass intended security controls. This improper enforcement creates a path for privilege escalation and credential exposure that directly contradicts the principle of least privilege and secure credential management practices.
The technical implementation flaw occurs when users with appropriate authentication credentials attempt to create or modify connection entries while the password saving feature has been explicitly disabled within the vault settings. The system fails to properly validate whether the Disable password saving configuration is active before permitting credential storage operations. This allows malicious or unauthorized users to persist credentials in vault entries despite explicit user configuration to prevent such behavior. The vulnerability operates at the application logic level, specifically within the connection management component where user preferences should be strictly enforced. It represents a failure in input validation and access control enforcement that violates fundamental security principles.
The operational impact of this vulnerability extends beyond simple credential exposure to encompass potential privilege escalation and lateral movement within compromised environments. When authenticated users can bypass password saving restrictions, they may inadvertently or deliberately store sensitive credentials in vault entries accessible to other users with appropriate permissions. This creates a persistent threat vector where credentials remain available even after initial access is lost, enabling attackers to maintain long-term presence within networks. The vulnerability particularly affects organizations relying on Devolutions Remote Desktop Manager for remote access management, as it undermines the security controls designed to prevent unauthorized credential storage and access. The exposure could lead to unauthorized system access, data breaches, and compliance violations in regulated environments.
Organizations should immediately implement mitigations including updating to the latest version of Devolutions Remote Desktop Manager where the vulnerability has been patched, implementing strict access controls for vault management, and conducting comprehensive audits of existing credential storage. System administrators should review and validate all existing connection entries for unauthorized credential persistence, while also implementing monitoring solutions to detect anomalous credential storage activities. The vulnerability aligns with CWE-693, which addresses protection mechanism failures, and relates to ATT&CK technique T1555.004 for credentials from password stores. Additionally, this issue demonstrates a failure in the principle of least privilege enforcement and violates security controls related to credential management and access control mechanisms. Organizations should also consider implementing additional layers of authentication and authorization controls to compensate for the vulnerability until full remediation is achieved.