CVE-2026-16801

Published: Jul 24, 2026Modified: Jul 29, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file.

Affected (1)

Products: Devolutions: Powershell Universal

1 product

Powershell Universal

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Devolutions Powershell Universal	Before 2026.2.3.0

Related CWEs

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (1)

https://devolutions.net/security/advisories/DEVO-2026-0025/

Source: security@devolutions.net

Vendor Advisory

Timeline

No history available yet.