CVE-2026-13372: Remote Desktop Manager PowerShell VPN Editor Privilege Escalation

Technical summary

CVE-2026-13372 is a link resolution vulnerability (CWE-706) in the custom PowerShell VPN editor component of Remote Desktop Manager. The affected versions (2026.2.5 through 2026.2.11) fail to properly disambiguate VPN script links when multiple entries share the same display name. During link resolution, the application does not enforce unique identification, allowing an attacker to craft a display name that collides with an existing legitimate VPN script link. When a user interacts with the workspace—particularly when loading or executing VPN configurations—the malicious script link may be resolved instead of the intended target, resulting in arbitrary PowerShell execution under the victim user's account context. The vulnerability is network-accessible and requires no user interaction beyond normal workspace usage, though successful exploitation depends on the attacker having prior write access to the shared workspace and knowledge of existing VPN script names.

Business impact

Organizations using Remote Desktop Manager in multi-user, shared workspace configurations face privilege escalation and lateral movement risks. An insider attacker (someone with workspace write access) can execute arbitrary PowerShell scripts as any other user who accesses the poisoned workspace, potentially enabling credential theft, data exfiltration, malware deployment, or unauthorized system modifications. This is particularly concerning in Managed Service Provider (MSP) and enterprise environments where Remote Desktop Manager centralizes access credentials and automation. The attack requires no sophisticated exploitation technique and leaves minimal forensic artifacts if the malicious script is designed to self-delete or obfuscate its origin.

Affected systems

Devolutions Remote Desktop Manager versions 2026.2.5, 2026.2.6, 2026.2.7, 2026.2.8, 2026.2.9, 2026.2.10, and 2026.2.11 are affected. The vulnerability is specific to installations using the custom PowerShell VPN editor feature with shared workspaces. Organizations should verify their installed version against the release notes. Versions outside the 2026.2.x range require validation against vendor advisories, as patch status may differ by major version or branch.

Exploitability

Exploitation requires authentication to the Remote Desktop Manager instance and write access to a shared workspace—effectively an insider threat scenario. The CVSS 3.1 score of 7.2 (HIGH) reflects high impact (confidentiality, integrity, and availability) coupled with high privileges required and no user interaction needed for execution. While the attack is not remotely exploitable by an external unauthenticated adversary, the low attack complexity means that once an attacker gains workspace write access, successful exploitation is nearly trivial. The threat is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting limited public weaponization at this time, but organizations should not assume this remains the case as awareness spreads.

Remediation

Upgrade to a patched version of Remote Desktop Manager released after June 29, 2026. Contact Devolutions directly or consult their advisory for the specific minimum safe version number. Organizations unable to patch immediately should enforce strict access controls on shared workspace write permissions, audit workspace membership and recent edits for unauthorized activity, and consider disabling or restricting the custom PowerShell VPN editor feature until patching is complete. Review PowerShell execution logs across user accounts to identify any suspicious script runs, particularly those with unusual display names or originating from workspace imports.

Patch guidance

Devolutions will have released patched builds addressing the link resolution logic. To upgrade, follow the vendor's standard update procedures for your deployment model (cloud, on-premises, or hybrid). After patching, validate that the PowerShell VPN editor correctly disambiguates scripts with identical or near-identical display names. Test in a non-production shared workspace first to confirm that legitimate VPN scripts still resolve and execute correctly. Document the patch date and affected version in your change management system.

Detection guidance

Monitor Windows PowerShell operational and security logs (Event IDs 4688, 4103, and 4104) for execution events originating from Remote Desktop Manager or from user accounts accessing the application. Look for unexpected or unauthorized PowerShell scripts, unusual script content (Base64 encoding, obfuscation), or execution patterns inconsistent with routine VPN operations. Review Remote Desktop Manager's audit logs for workspace modifications and VPN script additions, especially those with display names matching or closely resembling existing scripts. Consider implementing PowerShell Constrained Language Mode or script whitelisting if feasible in your environment. Alert on any PowerShell execution with suspicious command-line arguments or script blocks that perform credential manipulation, system reconnaissance, or persistence mechanisms.

Why prioritize this

This vulnerability should be prioritized for organizations with shared Remote Desktop Manager workspaces, especially those with multiple users, contractors, or MSP staff. The combination of high impact (code execution under any user's context), low complexity, and the insider threat vector makes it a significant privilege escalation risk. While the KEV status is currently false, the straightforward exploitation method means weaponization is likely inevitable. Patching should occur within 30 days for critical environments and 60 days for standard deployments. Organizations heavily reliant on Remote Desktop Manager for credential and access management should treat this as urgent.

Risk score, explained

The CVSS 3.1 HIGH score of 7.2 is driven by three factors: (1) High impact—successful exploitation compromises confidentiality, integrity, and availability through arbitrary code execution; (2) High privileges required—the attacker needs authentication and write access, narrowing the threat pool but not eliminating it for insider scenarios; (3) Low attack complexity—no special conditions are required beyond name collision, making the attack trivial once access is obtained. The network vector reflects that Remote Desktop Manager is typically network-accessible. The lack of user interaction requirement distinguishes this from phishing-dependent vulnerabilities, increasing the automatability of attacks. The score does not account for potential secondary impacts (stolen credentials, lateral movement) that could cascade through an organization.

Frequently asked questions