## Summary
CVE-2026-2590 affects Devolutions Remote Desktop Manager 2025.3.30 and earlier. It describes an improper enforcement of the “Disable password saving in vaults” setting, allowing an authenticated user to persist credentials in vault entries and potentially expose sensitive information to other users.
## Technical Details
- The issue is in the “connection entry component” of Devolutions Remote Desktop Manager.
- When the vault setting to disable password saving is enabled, the application can still be coerced into saving credentials by creating or editing certain connection types.
- Preconditions from the advisory: the attacker must be authenticated.
- Result: credentials may be persisted in vault entries despite the intended behavioral control, increasing the likelihood of sensitive data exposure to other users.
## Affected
- Devolutions Remote Desktop Manager 2025.3.30 and earlier
- (Also listed in the same advisory page) Devolutions Server 2025.3.15.0 and earlier, but this CVE specifically targets Remote Desktop Manager per the provided NVD description.
## Impact
- Credential persistence despite policy: users’ passwords can be saved into vault entries even when password saving is disabled.
- Confidentiality impact: persisted credentials could be exposed to other users.
- The provided CVSS indicates high severity (9.8) with network attack vector and no required user interaction.
## Mitigation
1. Upgrade Devolutions Remote Desktop Manager to a version that enforces the setting correctly (per the advisory, remediation is via upgrade; exact fixed version not stated in the provided reference excerpt).
2. If immediate upgrade is not possible, restrict access so only trusted authenticated users can create/edit connection entries (reduces the practical risk of abusing the setting bypass).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-20