Rocket Remote Desktop EUVD-2026-95969

The CVE describes Insufficiently Protected Credentials (CWE-522) in Rocket Remote Desktop 18.0.8583.1, meaning the product stores or transmits account credentials without adequate protection (e.g., weak, reversible, or cleartext encoding); the exact feature, file, or protocol is NOT stated in the one-line description and must be confirmed from the referenced RedTeam Pentesting advisory (rt-sa-2026-001). Limiting factors for defenders: realistic exploitation hinges on whether an attacker can actually reach the exposed credential material - if recovery requires local access to a stored credential blob or a man-in-the-middle position on the session traffic, true impact is narrower than the AV:N/PR:N CVSS vector implies. The description provides no evidence of required user interaction, and the authentication requirement to reach the flaw is not confirmed from available data beyond the NVD vector's PR:N claim, which conflicts with typical CWE-522 behavior.

Signals conflict sharply and should be weighed carefully. The NVD/MITRE CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) rates this as critical and remotely exploitable without authentication, but the EPSS score is only 0.14% (3rd percentile), it is NOT listed in CISA KEV, and no public exploit code is identified in the provided data. That combination points to a high-CVSS-but-low-observed-risk item rather than an active threat. There is also internal tension between the weakness class and the vector: CWE-522 (Insufficiently Protected Credentials) typically describes credentials stored or transmitted with weak/reversible protection, which usually yields a confidentiality-centric, access-dependent impact - not a full network-reachable, unauthenticated, C:H/I:H/A:H compromise. The 9.8 rating with PR:N/AV:N appears aggressive for a credential-protection flaw and should be verified against the vendor and the referenced red-team advisory before treating it as a drop-everything priority. SSVC-style framing: exploitation status is 'none' (no KEV, no confirmed POC), automatability is unproven, and technical impact is claimed total but unconfirmed. Net: a critical paper score with weak real-world exploitation evidence - prioritize patching where the product is deployed, but it does not currently show the hallmarks of widespread active exploitation.

An attacker who can reach the credential storage or transmission path of Rocket Remote Desktop 18.0.8583.1 recovers account credentials that are insufficiently protected (e.g., weakly or reversibly encrypted), then replays them to authenticate and take over remote sessions. A technical advisory from RedTeam Pentesting (rt-sa-2026-001) is referenced and likely documents the credential-recovery technique, but no weaponized public exploit code is identified in the provided data. Realistic feasibility depends heavily on whether credential exposure is truly network-reachable as the CVSS vector claims, which is unconfirmed from the sparse description.