The vulnerability CVE-2026-2590 affects Devolutions Remote Desktop Manager versions 2025.3.30 and earlier. It arises from improper enforcement of the 'Disable password saving in vaults' setting in the connection entry component. Authenticated users can bypass this restriction and persist credentials in vault entries, which should be prevented. This can lead to unauthorized access to sensitive credential information by other users sharing the vault. The CVSS score of 9.8 indicates a critical severity with network attack vector, low attack complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact.

An authenticated user can save credentials in vault entries despite the 'Disable password saving' setting being enabled, potentially exposing sensitive credentials to other users. This can lead to unauthorized disclosure of sensitive information and compromise of confidentiality, integrity, and availability within the affected Remote Desktop Manager environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to prevent unauthorized creation or editing of connection entries that could exploit this vulnerability. Monitor vendor communications for updates on patches or official fixes.