Devolutions Powershell Universal vulnerabilities

CVE-2026-16800 [HIGH] CWE-94 CVE-2026-16800: Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions Pow Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation.

CVE-2026-16801 [HIGH] CWE-94 CVE-2026-16801: Improper control of generation of code ('Code Injection') in the variables feature in Devolutions Po Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file.

CVE-2026-4064 [HIGH] CWE-862 CVE-2026-4064: Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026. Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service operations — via crafted gRPC requests.

CVE-2026-19768 [HIGH] CWE-94 CVE-2026-19768: Improper control of generation of code ('Code Injection') in the settings feature in Devolutions Pow Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.

CVE-2026-3277 [MEDIUM] CWE-312 CVE-2026-3277: The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stor The OpenID Connect (OIDC) authentication configuration in PowerShell Universal before 2026.1.3 stores the OIDC client secret in cleartext in the .universal/authentication.ps1 script, which allows an attacker with read access to that file to obtain the OIDC client credentials

CVE-2026-92237 [MEDIUM] CWE-532 CVE-2026-92237: Insertion of sensitive information into log file in the slow query logging feature in Devolutions Po Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL parameter values written to the system log on instances backe

CVE-2026-13437 [MEDIUM] CWE-201 CVE-2026-13437: Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.

CVE-2026-16798 [MEDIUM] CWE-201 CVE-2026-16798: Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShe Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.

CVE-2026-8694 [MEDIUM] CWE-306 CVE-2026-8694: Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthent Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.

CVE-2026-3563 [MEDIUM] CWE-1289 CVE-2026-3563: Improper input validation in the apps and endpoints configuration in PowerShell Universal before 202 Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path.

CVE-2026-16799 [MEDIUM] CWE-862 CVE-2026-16799: Improper access control in the automation tests and workflows features in Devolutions PowerShell Uni Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.

CVE-2026-16802 [MEDIUM] CWE-312 CVE-2026-16802: Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Univer Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.

CVE-2026-0618 [MEDIUM] CWE-79 CVE-2026-0618: Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Cross-site Scripting vulnerability in Devolutions PowerShell Universal.This issue affects Powershell Universal: before 4.5.6, before 5.6.13.