CVE-2026-16801
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
In Devolutions PowerShell Universal 2026.2.2 and earlier, the variables feature suffers from code injection. An authenticated user with variable write permission can execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the configuration file.
Risk Assessment
PowerShell code injection allows an attacker to execute arbitrary commands in the application context, potentially leading to full system compromise or data theft.
Recommendation
Update Devolutions PowerShell Universal to a version newer than 2026.2.2 that properly escapes variable values before writing to the configuration file.
Other vulnerabilities in Devolutions PowerShell Universal
See all- CVE-2026-19768High
In Devolutions PowerShell Universal version 2026.2.3 and earlier, a code injection vulnerability exists in the settings feature. An authenticated user with settings management permission can execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.
- CVE-2026-16802Medium
In Devolutions PowerShell Universal 2026.2.2 and earlier, the variables feature stores secret values in cleartext on disk when no vault is selected. A local attacker with file system access can read these secrets.
- CVE-2026-16800High
Code injection vulnerability in the schedule feature of Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with schedule creation permission can execute arbitrary PowerShell code via crafted schedule parameter names.
- CVE-2026-16799Medium
Improper access control in automation tests and workflows features of Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with Reader role can execute automation tests and modify workflow properties due to missing server-side authorization.
- CVE-2026-16798Medium
Sensitive information disclosure in the automation jobs API of Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with job or script read permission can obtain another user's OAuth refresh token via API responses that fail to strip the token.
- CVE-2026-13437Medium
In Devolutions PowerShell Universal 2026.2.0, a vulnerability was found involving the insertion of sensitive information into sent data in the AI Agent job API. An authenticated user with AI Agent read access can obtain reusable authentication tokens with potentially higher privileges, which are serialized in plaintext in job API responses.
- CVE-2026-8694Medium
Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.
Original NVD description (English source)
Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file.