CVE-2026-16800

HIGH

Devolutions PowerShell Universal < 2026.2.3 - Improper Control of Generation of Code ('Code Injection')

Title source: rule

Description

Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation.

References (1)

Core 1

Core References

https://devolutions.net/security/advisories/DEVO-2026-0025/

Scores

CVSS v3 8.8

EPSS 0.0029

EPSS Percentile 21.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-94

Status published

Products (2)

Devolutions/PowerShell Universal < 2026.2.3

devolutions/powershell_universal < 2026.2.3.0

Published Jul 24, 2026

Tracked Since Jul 24, 2026