Is CVE-2026-78417 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78417 being exploited in the wild.

How severe is CVE-2026-78417?

Medium severity, with a CVSS score of 4.3, published 24 August 2026.

Which products and versions are affected?

Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier.

Is there a fix for CVE-2026-78417?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-78417 attacked?

It is attacked over the network or from the adjacent network, in a hosted service.

Am I affected by CVE-2026-78417?

Check whether you run Devolutions Remote Desktop Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78417: Devolutions Remote Desktop Manager VNC man-in-the-middle via weak key verification

CVE-2026-78417 · Severity: medium · CVSS 4.3 · Published 2026-08-24

Devolutions Remote Desktop Manager is a widely-used enterprise tool for managing remote desktop and VNC connections. A flaw in the IronVNC client component allows an attacker positioned on the network path to intercept and tamper with VNC sessions by automatically accepting unverified RSA keys, potentially exposing remote desktop sessions to eavesdropping and manipulation without user awareness.

Technologies: Devolutions Remote Desktop Manager. Vendors: Devolutions.

Quick answers

Is CVE-2026-78417 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78417 being exploited in the wild.
How severe is CVE-2026-78417?: Medium severity, with a CVSS score of 4.3, published 24 August 2026.
Which products and versions are affected?: Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier.
Is there a fix for CVE-2026-78417?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-78417 attacked?: It is attacked over the network or from the adjacent network, in a hosted service.
Am I affected by CVE-2026-78417?: Check whether you run Devolutions Remote Desktop Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the IronVNC client used by Remote Desktop Manager, which fails to properly verify the authenticity of the VNC server's RSA key during RSA-AES authentication. An on-path attacker (network-positioned) can intercept the TLS/RSA handshake and substitute their own key, which the client automatically accepts without prompting or validating the certificate fingerprint. This allows the attacker to establish a man-in-the-middle position between the client and legitimate VNC server, gaining the ability to read and modify all encrypted session traffic. No user interaction beyond initiating a normal VNC connection is required. The issue affects Remote Desktop Manager versions 2026.2.17.0 and earlier, and 2026.1.24.0 and earlier; patches are available from Devolutions.

Affected products

Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier

Timeline

2026-08-24: disclosed
2026-08-24: advisory: DEVO-2026-0029

References

https://devolutions.net/security/advisories/DEVO-2026-0029/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.