Improper input validation in the SSH Elevate Shell feature allows an authenticated user with permission to create or modify a shared SSH entry to supply a crafted alternate username. When the user interacts with the Elevate Shell action, this username is sent to the remote SSH host using stored elevation credentials, enabling the execution of arbitrary commands on that host and potentially compromising its integrity. This is a CWE‑78 (OS Command Injection) flaw.

Devolutions Remote Desktop Manager, affected versions 2026.2.5.0 through 2026.2.7.0 and 2026.1.23.0 and earlier.

The CVSS score of 8.8 indicates a high severity vulnerability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. Attack requires an authenticated user with the ability to modify shared SSH entries, so the threat is limited to users with those permissions. Exploitation involves crafting a malicious alternate username that is then sent to the SSH host, resulting in remote code execution.