CVE-2026-12161: OS Command Injection
Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to execute arbitrary commands on a remote SSH host using stored elevation credentials via a crafted alternate username and user interaction with the Elevate Shell action.
This affects : - Remote Desktop Manager 2026.2.5.0 through 2026.2.7.0
- Remote Desktop Manager 2026.1.23.0 and earlier
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict the permission to create or modify shared SSH entries so only trusted administrators can perform these actions until a vendor-provided fix is available.
Devolutions Remote Desktop Manager permission to create/modify shared SSH entries = restricted to trusted administrators - Configuration
Disable the Elevate Shell action or remove access to it for users who do not require it until a vendor fix is available.
Devolutions Remote Desktop Manager Elevate Shell action = disabled - Compensating control
Restrict access to Remote Desktop Manager administrative interfaces and the ability to manage shared SSH entries to trusted networks/IPs and enable auditing/monitoring of creation/modification of shared SSH entries and use of Elevate Shell.
- Operational
Rotate any stored elevation credentials used by shared SSH entries and remove unnecessary stored elevation credentials to limit potential misuse.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-12161?
CVE-2026-12161 has a risk score of 57, indicating a moderate severity level.
How do I fix CVE-2026-12161?
To fix CVE-2026-12161, update Devolutions Remote Desktop Manager to version 2026.2.8 or later.
What type of vulnerability is CVE-2026-12161?
CVE-2026-12161 is classified as an improper input validation vulnerability leading to OS command injection.
Who is affected by CVE-2026-12161?
Authenticated users of Devolutions Remote Desktop Manager with permissions to modify shared SSH entries are affected by CVE-2026-12161.
When was CVE-2026-12161 published?
CVE-2026-12161 was published on June 15, 2026.