Rocket Remote Desktop: Insufficiently protected credentials in shared database
Summary
Rocket Remote Desktop stores the credentials for its central database in a configuration file, protected only by a static AES key. An attacker with local access to a client, or to the shared database or its backups, can decrypt the database credentials and the saved credentials of users who authenticated with password authentication. The vendor states that the attack is not directly exploitable from the Internet, while VulDB states that it can be initiated remotely, so the exposure is disputed.
Affected
- All releases according to RedTeam Pentesting, including Rocket Remote Desktop 2026 Patch 5
- The CVE record names only version 18.0.8583.1
- NVD status at time of research: Awaiting Analysis
Fixed in
- RedTeam Pentesting lists Rocket Remote Desktop 2027 as the fixed version.
- The vendor forum states that a fix is still in development. No released fix was confirmed in the sources reviewed.
- Verify the fixed build against the vendor release notes.
Workaround
- Until a fix is installed, do not save credentials in Rocket Remote Desktop, as advised by the vendor.
- Use password manager integration instead.
- Restrict read access to the Rocket Remote Desktop database and all of its backups.
Exploitation
- Publicly disclosed. RedTeam Pentesting advisory RT-SA-2026-001 describes the issue.
- CISA SSVC: proof of concept available, automatable: yes, technical impact: total.
- A proof-of-concept tool is referenced by the advisory, but its contents were not verified.
- Not listed in CISA KEV; no known exploitation in the wild.
Our recommendation
- Inventory all Rocket Remote Desktop installations, including versions and login methods.
- Check whether the preconditions apply: database environment, Windows Account login, and users with privately saved credentials.
- Where they apply, ask users to stop saving credentials and move them to a password manager.
- Restrict and audit access to the Rocket database and all backups.
- Track the vendor forum and install the fixed version once it is released and confirmed.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- RedTeam Pentesting advisory RT-SA-2026-001 www.redteam-pentesting.de
- Rocket Remote Desktop vendor forum thread remotedesktop.rocketsoftware.com
- Rocket Remote Desktop vendor forum remotedesktop.rocketsoftware.com
- CERT-Bund WID-SEC-2026-3855 wid.cert-bund.de
- VulDB entry for CVE-2026-78835 vuldb.com
- Rocket Software product page rocket.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 20:04.
Original description (NVD)
Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.