CVE-2026-2590

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper enforcement of the Disable password saving in vaults setting in the connection entry component in Devolutions Remote Desktop Manager 2025.3.30 and earlier allows an authenticated user to persist credentials in vault entries, potentially exposing sensitive information to other users, by creating or editing certain connection types while password saving is disabled.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-295

Affected software

VendorProductVersions
DevolutionsRemote Desktop Manager<= 2025.3.30

References

Timeline

Published
Mar 3, 2026
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-259006.1Lack of output escaping leads to a XSS vector in the feed modules.CVE-2026-259016.1Lack of output escaping leads to a XSS vector in the multilingual associations component.CVE-2026-259036.6Apache NiFi 1.1.0 through 2.7.2 are missing authorization when updating configuration properties on extension components that have specific CVE-2026-259045.8The Pydantic-AI MCP Run Python tool configures the Deno sandbox with an overly permissive configuration that allows the underlying Python coCVE-2026-259055.8The Python code being run by 'runPython' or 'runPythonAsync' is not isolated from the rest of the JS code, allowing any Python code to use tCVE-2026-259067.8Dell Optimizer, versions prior to 6.3.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privCVE-2026-259077.5Dell PowerScale OneFS, version 9.13.0.0, contains an overly restrictive account lockout mechanism vulnerability. An unauthenticated attackerCVE-2026-259087.8Dell Alienware Command Center (AWCC), versions prior to 6.13.8.0, contain an Execution with Unnecessary Privileges vulnerability in the AWCCCVE-2026-259164.3Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.CVE-2026-259177.2Dag Authors, who normally should not be able to execute code in the webserver context could craft XCom payload causing the webserver to execCVE-2026-259185.5unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-clCVE-2026-25927.7The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions
CVE-2026-2590: Critical severity, CVSS 9.8 | Vulnix