Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to supply a crafted alternate username. When the user then invokes the Elevate Shell action, the application passes the supplied credentials directly to the remote SSH host, enabling the attacker to execute arbitrary commands and potentially gain full control of the target system.

Devolutions Remote Desktop Manager, version 2026.2.7. The advisory explicitly mentions this release.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. Attack requires an authenticated user with the ability to modify shared SSH entries, so the threat is limited to users with those permissions. Exploitation involves crafting a malicious alternate username that is then sent to the SSH host, resulting in remote code execution.