Security readout for executives and security teams
Plain-English summary
CVE-2026-0747 is a low-severity information exposure issue in Devolutions Remote Desktop Manager for Windows. In the TeamViewer entry dashboard component, password masking can fail, allowing someone watching the screen or a screen share to see a password. Business urgency is mainly for environments where administrators share screens or work in observable spaces.
Executive priority
Handle through normal patch and credential hygiene processes, not emergency response, unless privileged passwords were shown during screen sharing or in public spaces.
Technical view
The issue is CWE-200 exposure of sensitive information. Sources describe affected Devolutions Remote Desktop Manager 2025.3.24.0 through 2025.3.28.0 on Windows. The CVSS 3.1 score is 3.3, with local attack vector, required user interaction, and low confidentiality impact. No integrity or availability impact is indicated.
Likely exposure
Exposure is limited to Windows installations of Devolutions Remote Desktop Manager in the cited affected version range, specifically when the TeamViewer entry dashboard component is used and the screen is observable.
Exploitation context
The attacker must be an external observer, such as someone physically present or watching a screen share. The source bundle does not indicate remote exploitation, credential theft without observation, or known active exploitation. CISA KEV status is false in the provided data.
Researcher notes
Evidence is limited to the CVE record and Devolutions advisory reference. The bundle does not include exploit reports, proof-of-concept details, or explicit fixed version information. Avoid assuming broader product impact beyond Windows Remote Desktop Manager and the TeamViewer entry dashboard component.
Mitigation direction
- Identify Windows Remote Desktop Manager installations in the affected version range.
- Review Devolutions advisory DEVO-2026-0002 for vendor remediation guidance.
- Avoid displaying TeamViewer entry dashboards during screen sharing until remediated.
- Limit physical shoulder-surfing risk for administrative workstations.
- Rotate any password that may have been visibly exposed.
Validation and detection
- Inventory installed Devolutions Remote Desktop Manager versions on Windows endpoints.
- Confirm whether TeamViewer entry dashboard entries are used.
- Check whether any affected versions are present: 2025.3.24.0 through 2025.3.28.0.
- Review recent screen-sharing sessions where affected dashboards may have been shown.
- Document any observed exposure and rotate impacted credentials.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-200: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-0747 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N1.81.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.3LowVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://devolutions.net/security/advisories/DEVO-2026-0002/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Exposure of Sensitive Information to an Unauthorized Actor
Exposure of Sensitive Information to an Unauthorized Actor represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.