The vulnerability originates from incorrect link resolution by display name in the custom PowerShell VPN editor. An authenticated attacker with write access to a shared workspace can create a VPN script link that collides with an existing display name, causing the system to resolve to the malicious script. This allows execution of PowerShell code in the context of another user, enabling arbitrary code execution within the workspace. The weakness is an unauthorized access flaw (CWE‑706).

Affected vendor and product are Devolutions Remote Desktop Manager. The issue applies to releases 2026.2.5 through 2026.2.11 inclusive. Any instance configured with shared workspaces and users with write privileges is potentially vulnerable.

The CVSS score is not published, and EPSS data is unavailable. The vulnerability is not listed in CISA KEV. Exploitation requires authenticated access with write permissions to a shared workspace, which is a narrower precondition than remote unauthenticated access. An attacker can trigger the flaw via the VPN editor UI or API. Because the attacker would gain execution rights in another user's context, the potential damage is high, though the attack surface is limited to environments where such workspaces are present and shared among multiple users.