CVE-2026-16802

MEDIUM

Devolutions PowerShell Universal < 2026.2.3 - Cleartext Storage of Sensitive Information

Title source: rule

Description

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.

References (1)

Core 1

Core References

https://devolutions.net/security/advisories/DEVO-2026-0025/

Scores

CVSS v3 6.5

EPSS 0.0008

EPSS Percentile 0.1%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-312

Status published

Products (2)

Devolutions/PowerShell Universal < 2026.2.3

devolutions/powershell_universal < 2026.2.3.0

Published Jul 24, 2026

Tracked Since Jul 24, 2026