CVE-2026-16801

HIGH

Devolutions PowerShell Universal < 2026.2.3 - Improper Control of Generation of Code ('Code Injection')

Title source: rule

Description

Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file.

References (1)

Core 1

Core References

https://devolutions.net/security/advisories/DEVO-2026-0025/

Scores

CVSS v3 8.8

EPSS 0.0029

EPSS Percentile 21.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact total

Details

CWE

CWE-94

Status published

Products (2)

Devolutions/PowerShell Universal < 2026.2.3

devolutions/powershell_universal < 2026.2.3.0

Published Jul 24, 2026

Tracked Since Jul 24, 2026