Insufficient verification of data authenticity in the IronVNC client in Devolutions Remote Desktop Manager 2026.2.17.0 and earlier, 2026.1.24.0 and… (CVE-2026-78417)

CVE-2026-78417 describes an insufficient verification of data authenticity vulnerability in the IronVNC client component of Devolutions Remote Desktop Manager. Specifically, the client automatically accepts the server's RSA key during RSA-AES authentication without proper validation, enabling an attacker positioned on the network path to intercept and modify VNC session data. This vulnerability affects versions 2026.2.17.0 and earlier, and 2026.1.24.0 and earlier. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An on-path attacker can intercept and tamper with VNC sessions by exploiting the automatic acceptance of the server's RSA key, potentially compromising the integrity of session data. There is no impact on confidentiality or availability, and no privileges are required to exploit this vulnerability. User interaction is required to trigger the vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when connecting to untrusted VNC servers and consider additional network protections such as VPNs or secure tunnels to mitigate on-path interception risks.