CVE-2026-12161: Remote Desktop Manager SSH Command Injection Vulnerability

Technical summary

CVE-2026-12161 is an improper input validation vulnerability (CWE-78: OS Command Injection) in Remote Desktop Manager's SSH Elevate Shell functionality. The vulnerability exists because user-supplied input in the alternate username field is not properly sanitized before being passed to the SSH command execution layer. An authenticated attacker with create or modify permissions on shared SSH entries can inject shell metacharacters or commands into the username parameter. When a user interacts with the Elevate Shell action, the unsanitized input is executed in the context of the stored elevation credentials, resulting in arbitrary OS command execution on the target SSH host. The attack surface is limited to users with existing SSH entry management permissions, but the impact is severe: full command execution with the privileges of the elevation credentials.

Business impact

This vulnerability poses a significant lateral movement and privilege escalation risk within environments using Remote Desktop Manager for centralized credential and SSH management. Organizations relying on RDM to enforce access controls and audit SSH activity may find those controls circumvented if an insider or compromised user exploits this flaw. The ability to execute arbitrary commands on remote hosts using stored elevation credentials could lead to data exfiltration, system compromise, or unauthorized infrastructure changes. Teams managing thousands of SSH connections through RDM—common in DevOps and system administration—should treat this as a priority, as exploitation could cascade across multiple critical systems accessed through a single RDM instance.

Affected systems

Devolutions Remote Desktop Manager versions 2026.2.5.0 through 2026.2.7.0 and all versions 2026.1.23.0 and earlier are affected. This includes the entire 2026.1.x line up to version 23.0. Organizations running any version in these ranges should assume they are vulnerable. The 2026.2.x line begins at 2026.2.5.0 with the vulnerability, meaning 2026.2.1.0 through 2026.2.4.x may be unaffected, but verify against the vendor advisory. Version identification can typically be found in RDM's Help > About dialog or via the Windows Add/Remove Programs control panel.

Exploitability

Exploitability is moderate to high, with a critical caveat: the attacker must already be authenticated to RDM and must have create or modify permissions on at least one shared SSH entry. The CVSS score of 8.8 reflects the severity of impact, not ease of exploitation. In environments with strong access controls, role-based permission enforcement, and audit logging, the attack surface is limited. However, in organizations with permissive RDM permission models or where multiple users share administrative accounts, the attack becomes more feasible. No public exploit code is known at this time, and the vulnerability is not yet tracked in CISA's KEV catalog, meaning active exploitation in the wild remains unconfirmed.

Remediation

Apply patches issued by Devolutions. For affected 2026.1.x users, upgrade to a patched version released after 2026.1.23.0 (verify version availability with Devolutions). For 2026.2.x users running versions 2026.2.5.0 through 2026.2.7.0, upgrade to the first patch version available after 2026.2.7.0. In parallel, implement compensating controls: restrict create and modify permissions on shared SSH entries to a minimal set of trusted administrators, enforce MFA on RDM administrative accounts, and ensure comprehensive audit logging of SSH entry modifications is enabled and reviewed.

Patch guidance

Devolutions will release patched versions outside the affected ranges. Monitor your RDM admin console and Devolutions' official security advisories for patch availability. Once a patch is confirmed available, plan a phased deployment: test in a non-production environment first, confirm that SSH elevation features function correctly post-patch, and deploy during a maintenance window if RDM is mission-critical to your operations. Verify the patch by checking the version number in Help > About; it should fall outside the affected version ranges (i.e., later than 2026.2.7.0 for the 2026.2.x line). No emergency out-of-band patches are currently indicated.

Detection guidance

Monitor RDM audit logs for modifications to shared SSH entries, particularly changes to username fields, and cross-reference with the user accounts making those changes. Look for SSH entry edits made by users not typically involved in credential or connection management. On remote SSH hosts, monitor command execution logs and authentication events for unexpected commands executed by service accounts or elevation users that do not correlate with known administrative tasks. Enable verbose SSH logging on target systems if available. Within RDM, enable detailed audit logging for all SSH elevation and Elevate Shell actions. Alert on rapid or bulk modifications to SSH entries, which may indicate reconnaissance or mass exploitation attempts.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH severity (CVSS 8.8) and the critical nature of SSH credential management. RDM is often deployed in environments where it controls access to high-value infrastructure, and a compromise here can cascade to widespread system intrusion. Although not yet in CISA's KEV catalog, the technical characteristics—OS command injection via a commonly-used administrative tool—make it an attractive target for insider threats and sophisticated attackers. Organizations should prioritize patching ahead of less critical flaws and reassess RDM permission models alongside remediation.

Risk score, explained

The CVSS 3.1 score of 8.8 (HIGH) reflects: Attack Vector = Network (RDM is typically accessed over the network), Attack Complexity = Low (crafting a malicious username is straightforward), Privileges Required = Low (only authenticated users with SSH entry modification rights), User Interaction = None (the exploit does not require the victim to perform an additional action beyond normal use), Scope = Unchanged, and Confidentiality/Integrity/Availability impact = High (arbitrary command execution enables theft, modification, and denial of service on remote hosts). The score appropriately captures the severity of achieving OS command execution on remote infrastructure, despite the requirement for prior authentication and permission.

Frequently asked questions