What is the CVSS score of CVE-2026-13372?

CVE-2026-13372 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Remote Desktop Manager are affected by CVE-2026-13372?

Devolutions Remote Desktop Manager versions 2026.2.5 through 2026.2.11 contain a privilege escalation flaw allowing authenticated users with shared workspace write access to execute malicious…. A patch is available.

How to fix or mitigate CVE-2026-13372?

Within 24 hours: Inventory all systems running Remote Desktop Manager 2026.2.5-2026.2.11 and obtain the patched version from Devolutions; restrict shared workspace write permissions to administrative users only. Within 7 days: Deploy vendor-released patch across all affected systems and verify successful installation. Within 30 days: Audit and document all users with workspace write access; implement principle-of-least-privilege controls for shared workspace permissions.

Remote Desktop Manager CVE-2026-13372

EUVD-2026-39832 HIGH

Use of Incorrectly-Resolved Name or Reference (CWE-706)

2026-06-26 DEVOLUTIONS

GHSA-m8cj-qf2v-5g2q

Information Disclosure Remote Desktop Manager Devolutions

7.2

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.1 HIGH

Shared workspace is networked (AV:N); needs collaborator write access not admin (PR:L); depends on a display-name collision plus victim running the link (AC:H, UI:R); arbitrary code in victim context yields C/I/A:H.

3.1 AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 21:30 vuln.today

CVSS changed

Jun 26, 2026 - 20:22 NVD

7.2 (HIGH)

Patch available

Jun 26, 2026 - 20:02 EUVD

CVE Published

Jun 26, 2026 - 18:22 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link.

AnalysisAI

Privilege/context escalation in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 lets an authenticated user with write access to a shared workspace plant a custom PowerShell VPN editor entry whose display name collides with an existing VPN script link, causing the attacker's PowerShell to run in another user's context when that link is resolved. The flaw stems from incorrect link resolution by display name (CWE-706) rather than a stable identifier, yielding total compromise of the victim's session (C:H/I:H/A:H). There is no public exploit identified at time of analysis and it is not in CISA KEV; a vendor patch is available.

Technical ContextAI

Remote Desktop Manager (RDM) is Devolutions' centralized connection/credential management platform used to organize RDP, SSH, VPN and other sessions, often shared across teams via shared workspaces (data sources/vaults). The vulnerability lives in the custom PowerShell VPN editor, a feature that lets users attach and run PowerShell scripts to establish VPN connections. RDM resolves the script 'link' by its human-readable display name instead of a unique immutable identifier - the root cause class CWE-706 (Use of Incorrectly-Resolved Name or Reference). Because resolution keys on the display name, a second entry created with the same display name can shadow or be mistaken for the legitimate VPN script link, so the reference points at attacker-controlled content. The single affected product per CPE is cpe:2.3:a:devolutions:remote_desktop_manager (versions 2026.2.5 up to but not including 2026.2.11).

RemediationAI

Upgrade Remote Desktop Manager to version 2026.2.11 or later, which is the fixed release per the Devolutions advisory DEVO-2026-0021 (https://devolutions.net/security/advisories/DEVO-2026-0021/); this is the primary and recommended fix. Until patched, reduce write access to shared workspaces to the minimum set of trusted users and audit shared workspaces for duplicate/colliding display names on VPN script entries - particularly newly created PowerShell VPN editor links whose display names match existing legitimate VPN links (trade-off: tightening write access can disrupt legitimate collaborative workflows). Where feasible, avoid running custom PowerShell VPN scripts from shared/multi-user workspaces and instead keep such scripts in per-user private vaults, accepting the loss of central sharing for those entries. Patch status: Patch available per vendor advisory (fixed version 2026.2.11).