CVE-2026-78417: IronVNC Client Authentication Vulnerability

CVE-2026-78417 Overview

CVE-2026-78417 is an insufficient data authenticity verification flaw [CWE-345] in the IronVNC client bundled with Devolutions Remote Desktop Manager. The IronVNC client automatically accepts the server's RSA key during RSA-AES authentication. This behavior allows an on-path attacker to intercept and tamper with Virtual Network Computing (VNC) sessions. The vulnerability affects Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, and 2026.1.24.0 and earlier.

Critical Impact
An on-path attacker can perform a man-in-the-middle (MITM) attack against VNC sessions, intercepting credentials and manipulating remote desktop traffic without user awareness.

Affected Products

Devolutions Remote Desktop Manager 2026.2.17.0 and earlier
Devolutions Remote Desktop Manager 2026.1.24.0 and earlier
IronVNC client component within Remote Desktop Manager

Discovery Timeline

2026-08-24 - CVE-2026-78417 published to the National Vulnerability Database (NVD)
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-78417

Vulnerability Analysis

The IronVNC client implements the RSA-AES authentication scheme defined for VNC connections. In a correctly implemented client, the server's RSA public key must be validated against a trusted fingerprint or presented to the user for verification before the AES session key is derived. The IronVNC client in Devolutions Remote Desktop Manager skips this validation and accepts any RSA key the server offers.

This behavior breaks the trust anchor of the authentication handshake. An attacker positioned on the network path can present their own RSA key, complete the handshake with the client, and independently establish a session with the real server. The attacker then relays traffic between both endpoints while retaining the ability to read and modify VNC session data, including keystrokes, screen contents, and clipboard transfers.

Root Cause

The root cause is a missing authenticity check on server-supplied cryptographic material. Under CWE-345 (Insufficient Verification of Data Authenticity), the client does not confirm that the RSA key belongs to the expected server. Automatic acceptance defeats the purpose of RSA-AES, which relies on the client rejecting untrusted keys.

Attack Vector

Exploitation requires an attacker in a network position between the client and the VNC server. Typical scenarios include compromised Wi-Fi networks, ARP spoofing on local networks, rogue gateways, or upstream routing manipulation. The attacker intercepts the initial VNC handshake, substitutes their RSA key, and proxies the connection. No user interaction beyond initiating the VNC session is required.

No verified public exploit code is available at this time. Refer to the Devolutions Security Advisory DEVO-2026-0029 for vendor technical details.

Detection Methods for CVE-2026-78417

Indicators of Compromise

Unexpected VNC sessions terminating and reconnecting to unusual intermediate hosts on TCP port 5900 or configured VNC ports
ARP table anomalies on client subnets indicating potential ARP spoofing preceding VNC connections
VNC server logs showing session sources that do not match the expected client IP addresses

Detection Strategies

Monitor Remote Desktop Manager audit logs for VNC connections established with RSA-AES authentication and correlate destination endpoints with an approved server inventory
Inspect network traffic for VNC handshakes where the server RSA public key fingerprint differs from previously observed values for the same destination
Alert on VNC sessions traversing unexpected network paths or terminating at non-authorized IP addresses

Monitoring Recommendations

Enable full session logging on VNC servers and cross-reference source addresses with authorized Remote Desktop Manager hosts
Deploy network detection rules that flag ARP cache poisoning and rogue DHCP responses on segments carrying administrative VNC traffic
Track outbound connections from workstations running Remote Desktop Manager to identify deviations from baseline destinations

How to Mitigate CVE-2026-78417

Immediate Actions Required

Upgrade Devolutions Remote Desktop Manager to a version later than 2026.2.17.0 on the 2026.2 branch or later than 2026.1.24.0 on the 2026.1 branch
Restrict VNC connections to trusted network segments or VPN tunnels until all clients are patched
Audit existing VNC entries in Remote Desktop Manager vaults and verify server identities out-of-band

Patch Information

Devolutions has published guidance in the Devolutions Security Advisory DEVO-2026-0029. Apply the fixed release identified in the advisory to enforce validation of the server's RSA key during RSA-AES authentication.

Workarounds

Route VNC traffic exclusively through authenticated VPN or SSH tunnels that provide independent endpoint verification
Disable RSA-AES authentication in favor of alternative authentication schemes that do not rely on client-side key acceptance, where operationally feasible
Segment administrative networks used for VNC sessions to reduce the likelihood of an on-path attacker gaining a foothold

bash

# Configuration example: restrict VNC egress to known server IPs via host firewall
# Windows PowerShell (run as Administrator) - example allowlist rule
New-NetFirewallRule -DisplayName "Allow VNC to trusted server" `
  -Direction Outbound -Protocol TCP -RemotePort 5900 `
  -RemoteAddress 10.0.20.15 -Action Allow

New-NetFirewallRule -DisplayName "Block all other VNC egress" `
  -Direction Outbound -Protocol TCP -RemotePort 5900 `
  -Action Block