1. Home
  2. CVE Database
  3. CVE-2026-2590
CRITICAL · 9.8

CVE-2026-2590

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to pe...

Vulnerability Description

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
DevolutionsRemote Desktop Manager<= 2025.3.30.0

Related Weaknesses (CWE)

CWE-20CWE-295

References

FAQ

What is CVE-2026-2590?

CVE-2026-2590 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to pe...

How severe is CVE-2026-2590?

CVE-2026-2590 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2026-2590?

Check the references section above for vendor advisories and patch information. Affected products include: Devolutions Remote Desktop Manager.