CVE-2026-13372: Remote Desktop Manager RCE Vulnerability

CVE-2026-13372 Overview

CVE-2026-13372 affects Devolutions Remote Desktop Manager (RDM) 2026.2.5 through 2026.2.11 on Windows. The flaw resides in the custom PowerShell Virtual Private Network (VPN) editor, which resolves script links by display name rather than by a unique identifier. An authenticated attacker with write access to a shared workspace can create a VPN script entry whose display name collides with an existing entry. When another user launches the original link, the attacker-supplied PowerShell script executes in that user's context. The vulnerability is tracked under CWE-706: Use of Incorrectly-Resolved Name or Reference and documented in Devolutions Security Advisory DEVO-2026-0021.

Critical Impact
Authenticated attackers with shared workspace write access can run arbitrary PowerShell code in the security context of other Remote Desktop Manager users.

Affected Products

Devolutions Remote Desktop Manager 2026.2.5 (Windows)
Devolutions Remote Desktop Manager 2026.2.6 through 2026.2.10 (Windows)
Devolutions Remote Desktop Manager 2026.2.11 (Windows)

Discovery Timeline

2026-06-26 - CVE-2026-13372 published to the National Vulnerability Database
2026-06-29 - CVE-2026-13372 record last modified in NVD

Technical Details for CVE-2026-13372

Vulnerability Analysis

Remote Desktop Manager stores connection entries, including custom PowerShell VPN scripts, in shared workspaces used by multiple operators. The custom PowerShell VPN editor resolves script references by display name rather than by an immutable identifier such as a GUID. Any authenticated user with write privileges to the shared workspace can add or rename an entry to match the display name of a legitimate VPN script. When a target user opens the intended connection, RDM resolves the name to the attacker-controlled entry and executes the associated PowerShell code under the target user's Windows session. This grants the attacker the full impact on confidentiality, integrity, and availability tied to that user's account, including access to any stored credentials, mapped drives, and remote sessions accessible from that host.

Root Cause

The root cause is name-based reference resolution without uniqueness enforcement. The editor treats display names as authoritative link targets, so duplicate names silently override the expected script. This is a classic instance of [CWE-706], where a security-sensitive operation relies on a mutable, non-unique attribute.

Attack Vector

Exploitation is network-based but requires an authenticated account with write access to a shared RDM workspace. The attacker creates a malicious PowerShell VPN entry whose display name matches an existing script, then waits for another user to invoke that link. No user interaction beyond the normal act of launching the VPN connection is required. Refer to Devolutions Security Advisory DEVO-2026-0021 for vendor-confirmed details.

Detection Methods for CVE-2026-13372

Indicators of Compromise

New or renamed custom PowerShell VPN entries in shared RDM workspaces whose display names duplicate existing entries.
Unexpected powershell.exe child processes spawned by RemoteDesktopManager.exe on operator workstations.
PowerShell script blocks referencing outbound network calls, credential access, or file staging launched from RDM contexts.

Detection Strategies

Audit the RDM shared workspace database and activity logs for duplicate display names across VPN script entries.
Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging on hosts running RDM to capture executed script content.
Correlate Windows Event ID 4688 process creation events showing RemoteDesktopManager.exe as the parent of powershell.exe with unusual command lines.

Monitoring Recommendations

Alert on modifications to shared RDM entries performed by accounts that do not typically manage VPN configurations.
Monitor for PowerShell execution originating from RDM that touches sensitive paths such as %APPDATA%, LSASS, or credential stores.
Review RDM audit logs regularly for entry creation, rename, and permission changes within shared vaults.

How to Mitigate CVE-2026-13372

Immediate Actions Required

Upgrade Devolutions Remote Desktop Manager to a fixed version above 2026.2.11 as published in Devolutions Security Advisory DEVO-2026-0021.
Review shared workspaces for duplicate-named custom PowerShell VPN entries and remove any that were not created by authorized administrators.
Restrict write permissions on shared workspaces to a minimal set of trusted administrators.

Patch Information

Devolutions has published a security advisory tracking this issue as DEVO-2026-0021. Administrators should apply the vendor-supplied update that supersedes RDM 2026.2.11 on Windows. Consult Devolutions Security Advisory DEVO-2026-0021 for the exact fixed build and release notes.

Workarounds

Limit shared workspace write access using RDM role-based permissions until the patched version is deployed.
Disable or remove custom PowerShell VPN entries from shared vaults and store them in private vaults where feasible.
Enforce PowerShell Constrained Language Mode and application control policies on operator endpoints to reduce the impact of unintended script execution.

bash

# Example: enumerate PowerShell child processes of RemoteDesktopManager.exe
# Run on operator workstations to hunt for suspicious executions
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688} |
  Where-Object { $_.Message -match 'powershell.exe' -and $_.Message -match 'RemoteDesktopManager.exe' } |
  Select-Object TimeCreated, Message