This vulnerability (CVE-2026-12161) involves improper neutralization of special elements used in OS commands (CWE-78) within the SSH Elevate Shell feature of Devolutions Remote Desktop Manager. An authenticated user who can create or modify shared SSH entries can exploit this flaw by crafting an alternate username and interacting with the Elevate Shell action to execute arbitrary commands on a remote SSH host using stored elevation credentials. The affected versions include 2026.1.23.0 and earlier, and 2026.2.5.0 through 2026.2.7.0. The CVSS v3.1 base score is 8.8, indicating high severity with network attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed by the vendor as of the published date.

Successful exploitation allows an authenticated user with permission to create or modify shared SSH entries to execute arbitrary OS commands on a remote SSH host with elevated credentials. This can lead to full compromise of the remote system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict permissions to create or modify shared SSH entries to trusted users only and monitor for suspicious activity related to the SSH Elevate Shell feature.