Home / Vulnerability Intelligence / CVE-2026-2590

CVE-2026-2590 - Vulnerability Analysis

CriticalCVSS: 9.8

Last Updated: March 5, 2026

Devolutions Remote Desktop Manager - Broken Access Control

Published: March 3, 2026Updated: March 5, 2026Remote Exploitable

Overview

Devolutions Remote Desktop Manager <= 2025.3.30 contains a broken access control caused by improper enforcement of the disable password saving setting in connection entry component, letting authenticated users persist credentials despite password saving being disabled, exploit requires user authentication.

Severity & Score

Severity: Critical

CVSS Score: 9.8

EPSS Score: 1.5%(Probability of exploitation in next 30 days)

Impact

Authenticated users can persist credentials despite restrictions, potentially exposing sensitive information to other users.

Mitigation

Update to the latest version beyond 2025.3.30.

References

https://devolutions.net/security/advisories/DEVO-2026-0005

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 4, 2026

🔴 CVE-2026-2590 - Critical (9.8) Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentiall... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-2590/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 4, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-2590
Severity: Critical
CVSS Score: 9.8
Type: broken_access_control
Status: confirmed
EPSS: 1.5%
Social Posts: 2

CWE

CWE-20

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

1.5%Probability of exploitation in the next 30 days