CVE-2026-13372: High severity Devolutions Remote Desktop Manager vulnerability
Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13372?
The severity of CVE-2026-13372 is high with a CVSS score of 7.2.
How do I fix CVE-2026-13372?
To fix CVE-2026-13372, update Devolutions Remote Desktop Manager to version 2026.2.12 or later.
What type of attack does CVE-2026-13372 facilitate?
CVE-2026-13372 allows an authenticated attacker with write access to execute PowerShell scripts in another user's context.
Who is affected by CVE-2026-13372?
Users of Devolutions Remote Desktop Manager versions 2026.2.5 through 2026.2.11 are affected by CVE-2026-13372.
What does CVE-2026-13372 involve?
CVE-2026-13372 involves incorrect link resolution by display name in the custom PowerShell VPN editor.