Is CVE-2026-2590 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-2590 being exploited in the wild.

How severe is CVE-2026-2590?

Critical severity, with a CVSS score of 9.8, published 3 March 2026.

Which products and versions are affected?

Devolutions Remote Desktop Manager 2025.3.30 and earlier; Devolutions Devolutions Server 2025.3.15.0 and earlier.

Is there a fix for CVE-2026-2590?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-2590 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-2590?

Check whether you run Devolutions Remote Desktop Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-2590: Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions…

CVE-2026-2590 · Severity: critical · CVSS 9.8 · Published 2026-03-03

Devolutions Remote Desktop Manager, a tool used by IT teams to manage remote connections and credentials, contains a flaw that fails to enforce security policies regarding password storage. This allows users to save credentials in shared vaults even when administrators have explicitly disabled that feature. This could lead to the unauthorized persistence and potential exposure of sensitive login information to other users within the organization.

Technologies: Devolutions Remote Desktop Manager. Vendors: Devolutions.

Quick answers

Is CVE-2026-2590 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-2590 being exploited in the wild.
How severe is CVE-2026-2590?: Critical severity, with a CVSS score of 9.8, published 3 March 2026.
Which products and versions are affected?: Devolutions Remote Desktop Manager 2025.3.30 and earlier; Devolutions Devolutions Server 2025.3.15.0 and earlier.
Is there a fix for CVE-2026-2590?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-2590 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-2590?: Check whether you run Devolutions Remote Desktop Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the connection entry component of Devolutions Remote Desktop Manager (and Devolutions Server) results from improper enforcement of the 'Disable password saving in vaults' security setting. Authenticated users can bypass this restriction by creating or editing specific connection types, allowing them to save and persist credentials within vault entries. This flaw can lead to unauthorized credential disclosure to other users who have access to the same vault. The issue is addressed in versions newer than 2025.3.30 for Remote Desktop Manager and 2025.3.15.0 for Devolutions Server.

Affected products

Devolutions Remote Desktop Manager 2025.3.30 and earlier
Devolutions Devolutions Server 2025.3.15.0 and earlier

Timeline

2026-03-03: disclosed: Initial publication of the advisory.
2026-03-03: advisory: Vendor advisory DEVO-2026-0005 published.

References

https://devolutions.net/security/advisories/DEVO-2026-0005

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.