What is the CVSS score of EUVD-2026-37023?

EUVD-2026-37023 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Remote Desktop Manager are affected by EUVD-2026-37023?

Devolutions Remote Desktop Manager up to version 2026.2.7 contains an authenticated OS command injection vulnerability in the SSH Elevate Shell feature that allows users with shared SSH entry…

How to fix or mitigate EUVD-2026-37023?

Within 24 hours: Audit all user permissions for shared SSH entry creation and modification in RDM; restrict these capabilities to administrators only and document current version inventory across all deployments. Within 7 days: Review access logs for suspicious modifications to SSH entries and implement approval workflows for any SSH entry changes. Within 30 days: Monitor Devolutions security advisories for patch release to version 2026.2.8 or later; apply immediately upon availability. Implement network segmentation to limit SSH host access from RDM workstations as an interim control.

Remote Desktop Manager EUVD-2026-37023

| CVE-2026-12161 HIGH

OS Command Injection (CWE-78)

2026-06-15 DEVOLUTIONS

GHSA-w469-xxf5-q946

Command Injection Remote Desktop Manager

8.8

CVSS 3.1 · Vendor: DEVOLUTIONS

Severity by source

Vendor (DEVOLUTIONS) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Requires authenticated RDM user with shared-entry edit rights (PR:L) and a second user clicking Elevate Shell (UI:R); injection is straightforward over the network with full C/I/A impact on the target host.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (DEVOLUTIONS).

CVSS VectorVendor: DEVOLUTIONS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 17:22 vuln.today

CVSS changed

Jun 16, 2026 - 17:22 NVD

8.8 (HIGH)

CVE Published

Jun 15, 2026 - 23:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Improper input validation in the SSH Elevate Shell feature in Devolutions Remote Desktop Manager 2026.2.7 allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action.

AnalysisAI

OS command injection in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager up to 2026.2.7 lets an authenticated user who can create or modify a shared SSH entry execute arbitrary commands on remote SSH hosts by smuggling shell metacharacters through a crafted alternate username, abusing stored elevation credentials they would not otherwise possess. No public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), but the privilege-escalation angle - turning shared-entry write access into code execution under another user's sudo/elevation context - makes this attractive for insider or post-compromise abuse.

Technical ContextAI

Remote Desktop Manager is a connection-management workstation tool that brokers SSH/RDP/SQL sessions and centrally stores credentials, including separate "elevation" credentials used by the Elevate Shell feature to run privileged commands (e.g., sudo) once the SSH session is established. The flaw is CWE-78 (OS Command Injection): the alternate-username field consumed by the Elevate Shell action is concatenated into a shell command without sufficient validation or quoting, so shell metacharacters in that field are interpreted by the remote shell. Because the elevation password is read from the shared vault and supplied automatically when the user triggers Elevate Shell, an attacker who controls the entry definition can execute commands under privileges they were never granted directly. The affected CPE is cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:*:*:* through 2026.2.7.

RemediationAI

Upgrade Remote Desktop Manager to the fixed release referenced in Devolutions advisory DEVO-2026-0018 (https://devolutions.net/security/advisories/DEVO-2026-0018/); the input data does not include an exact fixed build number, so consult the advisory for the precise version above 2026.2.7. Until patched, restrict who can create or modify shared SSH entries by tightening data-source role permissions so only fully trusted administrators can edit shared entries that carry elevation credentials (trade-off: extra approval friction for legitimate entry maintainers). Additionally, avoid using Elevate Shell with stored credentials on shared SSH entries you did not author, and audit existing entries for unexpected values in the alternate-username field; defenders should also enable SSH server-side command auditing on hosts that accept Elevate Shell sessions so any injected commands are at least logged.