The vulnerability is identified as insufficiently protected credentials in Rocket Remote Desktop 18.0.8583.1. It indicates that login credentials may be exposed or stored without adequate protection, allowing an attacker to obtain valid credentials. This could enable unauthorized access to a remote desktop session, compromising the confidentiality and integrity of data accessed through the service.

The affected vendor is Rocket Software, with the product Rocket Remote Desktop. The vulnerability applies to the 18.0.8583.1 build; other releases are not confirmed as vulnerable.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of <1% suggests a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA KEV. Attackers may target the authentication mechanism to obtain credentials, though the exact attack vector is not specified in the available data and is inferred. No vendor workaround is provided, so the main risk is exploitation of exposed credentials.