CVE-2026-78417

MediumCVSS 4.3/10Last modified Oct 12, 2026

Description

Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-345

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 24, 2026
Last modified
Oct 12, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-78426.8The Infility Global Infility Global WordPress plugin before 2.15.20 for WordPress does not sanitize or validate the orderby and order parameCVE-2026-784227.3Subject::new_for_owner() in the zbus_polkit crate encodes the uid entry of a unix-process polkit subject as an unsigned 32-bit integer (D-BuCVE-2026-784248.8Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyonCVE-2026-784257.6Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expeCVE-2026-784262.0The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that haCVE-2026-784275.3The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded serCVE-2026-784288.8For users authenticated through SAML or OpenID Connect (OIDC), this vulnerability can result in one user receiving another user's authenticaCVE-2026-784305.3A vulnerability was detected in sworddut mcp-ffmpeg-helper 0.1.0/0.1.1/0.2.1. This affects the function handleToolCall of the file src/toolsCVE-2026-784335.9Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissiCVE-2026-784346.5A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/ControCVE-2026-784353.8A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesCVE-2026-784377.3Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from anoth
CVE-2026-78417: Medium severity, CVSS 4.3 | Vulnix