CVE-2026-12161: Improper input validation in the SSH Elevate Shell feature in

Synopsis

Improper input validation in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager 2026.2.7 allows an authenticated attacker to execute arbitrary commands on a remote SSH host. The vulnerability is reachable over the network and requires only a low-privilege account with permission to create or modify a shared SSH entry; no victim interaction beyond a target user triggering the Elevate Shell action is needed. Successful exploitation gives the attacker full command execution on the remote SSH host using stored elevation credentials. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Remote Desktop Manager service over the network; the affected feature is exposed to network-accessible clients.

• AuthenticationRequired

  Any low-privilege account that holds permission to create or modify a shared SSH entry is sufficient to attempt exploitation; no administrative account is needed.

• Victim interactionRequired

  A target user must trigger the Elevate Shell action against the crafted SSH entry, making this a social-engineering or insider-threat scenario where the attacker plants a malicious entry and waits for another user to activate it.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond holding the necessary account permission.

Blast Radius

• Executes arbitrary operating-system commands on the remote SSH host using the stored elevation credentials, which typically carry elevated or root-level privileges.
• Reads files, secrets, and credentials accessible to the elevated session on the remote host.
• Writes or modifies files and configurations on the remote host, enabling persistence or lateral movement to other systems reachable from that host.
• Crashes or disrupts processes on the remote host if the attacker chooses to run destructive commands.