CVE-2026-13372CWE-706

Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an…

High · published June 26, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
41.9
In the wild
Unconfirmed
What it is

Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00499 · 41.9th percentile
Weakness
CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2026-06-26T18:22Z
EPSS history
Timeline
  • 26 JUN 18:22Z
    Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an…
    cvelistv5