CVE-2026-78417 in Remote Desktop Manager
Summary
by MITRE • 08/24/2026
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in Devolutions Remote Desktop Manager involves a critical flaw within the IronVNC client component, specifically affecting versions 2026.2.17.0 and earlier as well as 2026.1.24.0 and earlier. This security deficiency centers on insufficient verification of data authenticity during the VNC authentication process. In standard secure remote desktop protocols, it is imperative that clients rigorously validate server identities to prevent man-in-the-middle attacks. However, in this specific implementation, the client automatically accepts the RSA key presented by the connecting server without performing adequate checks against a known list of trusted keys or verifying the certificate chain integrity. This design choice effectively bypasses standard cryptographic validation procedures that are essential for establishing a secure and authenticated session.
From a technical perspective, the flaw resides in how the IronVNC client handles RSA-AES authentication. When an attacker positions themselves on the network path between the client and the legitimate VNC server, they can intercept the initial handshake messages. Because the client is configured to automatically accept any presented RSA key without verifying its authenticity or comparing it against previously trusted fingerprints, the attacker can present a forged public key. The client accepts this malicious key as valid, thereby establishing an encrypted tunnel with the attacker rather than the intended remote host. This allows the on-path attacker to decrypt, inspect, and potentially modify all traffic flowing through the session without triggering any security warnings or requiring user intervention beyond the initial connection request.
The operational impact of this vulnerability is severe, particularly in enterprise environments where Remote Desktop Manager is used for managing access to critical infrastructure. An adversary exploiting this flaw can achieve a complete man-in-the-middle position within VNC sessions. This capability enables several malicious outcomes including credential harvesting through keystroke logging, session hijacking to gain unauthorized control over remote systems, and data exfiltration of sensitive information transmitted during the desktop session. Furthermore, because the vulnerability allows for traffic tampering, an attacker could inject malicious commands or code into the session, potentially leading to further compromise of the target system. The lack of user notification regarding key changes means that administrators may remain unaware that their connection is being intercepted and manipulated in real-time.
This issue aligns with CWE-295 Improper Certificate Validation, as the software fails to properly validate the authenticity of the X.509 certificate or public key presented by the server. Additionally, it maps to MITRE ATT&CK technique T1078 Valid Accounts and potentially T1046 Network Service Discovery depending on how the attacker leverages the intercepted session for lateral movement. The automatic acceptance of keys without verification is a common anti-pattern in cryptographic implementations that prioritizes convenience over security, leading to significant exposure risks.
To mitigate this vulnerability, organizations should immediately update Devolutions Remote Desktop Manager and its IronVNC client components to versions released after 2026.1.24.0 and 2026.2.17.0 where these authentication checks have been corrected. Until the patch is applied, administrators can implement network-level controls such as firewall rules that restrict VNC traffic to known IP addresses or utilize virtual private networks to ensure that connections are not exposed to on-path attackers. Additionally, enabling strict certificate pinning if supported by newer configurations and educating users about verifying connection fingerprints manually can provide a layer of defense against this specific type of interception attack. Regular audits of remote access policies and the enforcement of multi-factor authentication for administrative consoles further reduce the risk associated with compromised credentials or intercepted sessions.