CVE-2026-92237
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
In Devolutions PowerShell Universal 2026.2.5 and earlier, the slow query logging feature writes SQL parameter values, including sensitive information, to the system log. An authenticated user with log read permission can thereby obtain application tokens, data protection key material and other stored credentials on instances backed by Microsoft SQL Server.
Risk Assessment
A user with log read permission can obtain tokens and cryptographic keys, enabling privilege escalation and access to protected data. This poses a serious credential exposure risk in Microsoft SQL Server-backed environments.
Recommendation
Update Devolutions PowerShell Universal to a version later than 2026.2.5. Restrict log read permissions and review existing logs for exposed credentials, rotating them if necessary.
Other vulnerabilities in Devolutions PowerShell Universal
See all- CVE-2026-19768High
In Devolutions PowerShell Universal version 2026.2.3 and earlier, a code injection vulnerability exists in the settings feature. An authenticated user with settings management permission can execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.
- CVE-2026-16802Medium
In Devolutions PowerShell Universal 2026.2.2 and earlier, the variables feature stores secret values in cleartext on disk when no vault is selected. A local attacker with file system access can read these secrets.
- CVE-2026-16801High
In Devolutions PowerShell Universal 2026.2.2 and earlier, the variables feature suffers from code injection. An authenticated user with variable write permission can execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the configuration file.
- CVE-2026-16800High
Code injection vulnerability in the schedule feature of Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with schedule creation permission can execute arbitrary PowerShell code via crafted schedule parameter names.
- CVE-2026-16799Medium
Improper access control in automation tests and workflows features of Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with Reader role can execute automation tests and modify workflow properties due to missing server-side authorization.
- CVE-2026-16798Medium
Sensitive information disclosure in the automation jobs API of Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with job or script read permission can obtain another user's OAuth refresh token via API responses that fail to strip the token.
- CVE-2026-13437Medium
In Devolutions PowerShell Universal 2026.2.0, a vulnerability was found involving the insertion of sensitive information into sent data in the AI Agent job API. An authenticated user with AI Agent read access can obtain reusable authentication tokens with potentially higher privileges, which are serialized in plaintext in job API responses.
- CVE-2026-8694Medium
Improper access control in Devolutions PowerShell Universal 2026.1.7 and earlier allows an unauthenticated remote attacker to obtain the OpenAPI specification of user-defined REST endpoints.
Original NVD description (English source)
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL parameter values written to the system log on instances backed by Microsoft SQL Server.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS