CVE-2026-12161: Remote Desktop Manager RCE Vulnerability

CVE-2026-12161 Overview

CVE-2026-12161 is an improper input validation vulnerability in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager 2026.2.7. An authenticated user with permission to create or modify a shared SSH entry can execute arbitrary commands on a remote SSH host. The attack uses stored elevation credentials through a crafted alternate username, triggered when another user interacts with the Elevate Shell action. The flaw is tracked under CWE-78 (OS Command Injection) and affects Devolutions Remote Desktop Manager on Windows.

Critical Impact
Authenticated attackers can execute arbitrary commands on remote SSH hosts using stored elevation credentials, leading to full compromise of confidentiality, integrity, and availability on targeted systems.

Affected Products

Devolutions Remote Desktop Manager 2026.2.7 (Windows)
Shared SSH entries configured with the Elevate Shell feature
Environments using stored elevation credentials for privileged SSH access

Discovery Timeline

2026-06-16 - CVE-2026-12161 published to NVD
2026-06-17 - Last updated in NVD database
Vendor advisory - Devolutions Security Advisory DEVO-2026-0018

Technical Details for CVE-2026-12161

Vulnerability Analysis

The vulnerability resides in the SSH Elevate Shell feature, which allows users to escalate privileges on a remote host using stored credentials. The feature accepts an alternate username field that is not properly validated before being passed to the underlying shell command. An attacker with write access to a shared SSH entry can inject shell metacharacters into the alternate username. When a legitimate user later triggers the Elevate Shell action, the injected payload runs on the remote host with the privileges of the stored elevation account. The attack leverages user interaction, meaning the malicious entry must be invoked by another authorized user. The vulnerability has an EPSS probability of 0.294% with a percentile of 20.925, indicating moderate predicted exploitation likelihood compared to other CVEs.

Root Cause

The root cause is missing sanitization of the alternate username parameter in the SSH Elevate Shell workflow. The application concatenates user-controlled input into a command string passed to the remote SSH session without escaping shell metacharacters or enforcing a strict allowlist for username syntax. This classifies under CWE-78, Improper Neutralization of Special Elements used in an OS Command.

Attack Vector

Exploitation requires an authenticated user with permission to create or modify a shared SSH entry, plus interaction from a second user who initiates the Elevate Shell action. The attacker stores a malicious alternate username containing command separators or substitution sequences. When the victim triggers elevation, the crafted payload executes on the remote SSH host using the stored elevation credentials. The vulnerability manifests as command injection chained with credential reuse. Refer to the Devolutions advisory for vendor-supplied technical specifics; no public proof-of-concept is available.

Detection Methods for CVE-2026-12161

Indicators of Compromise

Shared SSH entries in Remote Desktop Manager with alternate username fields containing shell metacharacters such as ;, &&, |, $(), or backticks.
Unexpected commands executed on SSH hosts under elevation accounts immediately following an Elevate Shell action.
Modifications to shared SSH entry definitions by users who do not normally administer those entries.

Detection Strategies

Audit Remote Desktop Manager shared vault entries for non-standard characters in the alternate username field of SSH entries.
Correlate SSH session logs on target hosts with Remote Desktop Manager activity logs to identify command execution that does not match interactive user behavior.
Monitor for new or modified shared SSH entries created by accounts with elevated vault permissions.

Monitoring Recommendations

Enable Remote Desktop Manager activity logging and forward events to a centralized SIEM for correlation.
Track invocations of the Elevate Shell action and capture the parameters used during execution.
Alert on SSH server-side auth.log or shell history entries that show command chaining after sudo or su elevation.

How to Mitigate CVE-2026-12161

Immediate Actions Required

Upgrade Devolutions Remote Desktop Manager to a fixed version as listed in Devolutions Security Advisory DEVO-2026-0018.
Restrict permissions to create or modify shared SSH entries to a minimal set of trusted administrators.
Review existing shared SSH entries for suspicious alternate username values and remove or sanitize them.

Patch Information

Devolutions has published remediation guidance in advisory DEVO-2026-0018. Administrators should consult the Devolutions advisory for the specific fixed build and apply it across all Remote Desktop Manager clients in the environment. Versions at or below 2026.2.7 on Windows are confirmed affected.

Workarounds

Disable or avoid use of the SSH Elevate Shell feature until patching is complete.
Rotate stored elevation credentials referenced by shared SSH entries to limit the impact of prior tampering.
Apply role-based access controls so that only vetted users can edit shared SSH entries in the vault.

bash

# Configuration example: restrict who can modify shared SSH entries
# In Devolutions Remote Desktop Manager vault permissions:
# - Set 'Edit' permission on SSH entries to a dedicated admin role only
# - Grant 'View/Execute' to standard users
# - Audit changes via: Administration > Logs > Vault Activity