CVE-2026-78417: Devolutions Remote Desktop Manager vulnerability
Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and earlier, allows an on-path attacker to intercept and tamper with VNC sessions via automatic acceptance of the server's RSA key during RSA-AES authentication.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of the IronVNC client in Devolutions Remote Desktop Manager are exposed when connecting over a network path where an attacker can intercept the VNC session. The affected release ranges are 2026.2.17.0 and earlier and 2026.1.24.0 and earlier.
What does an attacker need to exploit it?
The attacker must be on the network path between the client and the VNC server, allowing them to intercept the connection. Exploitation relies on the client automatically accepting the server RSA key during RSA-AES authentication.
What could an attacker do after exploiting this issue?
An on-path attacker can intercept and tamper with VNC sessions. The provided information does not state whether this also permits access beyond the affected session.