VYPR
← All advisories
High severity7.2NVD Advisory· Published Jun 26, 2026· Updated Jun 29, 2026

CVE-2026-13372

CVE-2026-13372

Description

Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link.

Affected products

2
  • Devolutions/Remote Desktop Manager2 versions
    cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:windows:*:*+ 1 more
    • cpe:2.3:a:devolutions:remote_desktop_manager:*:*:*:*:*:windows:*:*range: >=2026.2.5.0,<=2026.2.12.0
    • (no CPE)range: 2026.2.5 - 2026.2.11

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.