CVE-2026-16801

Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2026-0025/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*

History

24 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Control inadecuado de la generación de código (’Inyección de código’) en la funcionalidad de variables en Devolutions PowerShell Universal 2026.2.2 y versiones anteriores permite a un usuario autenticado con permiso de escritura de variables ejecutar código PowerShell arbitrario mediante un valor de variable manipulado que no se escapa correctamente cuando se escribe en el archivo de configuración de variables.

Information

Published : 2026-07-24 15:17

Updated : 2026-10-24 13:10

NVD link : CVE-2026-16801

Mitre link : CVE-2026-16801

CVE.ORG link : CVE-2026-16801

JSON object : View

Products Affected

devolutions

powershell_universal

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-16801", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-16801", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-24T17:40:22.810958Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "PowerShell Universal", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.2.3", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-24T15:17:13.077", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0025/", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file."}, {"lang": "es", "value": "Control inadecuado de la generaci\u00f3n de c\u00f3digo (\u2019Inyecci\u00f3n de c\u00f3digo\u2019) en la funcionalidad de variables en Devolutions PowerShell Universal 2026.2.2 y versiones anteriores permite a un usuario autenticado con permiso de escritura de variables ejecutar c\u00f3digo PowerShell arbitrario mediante un valor de variable manipulado que no se escapa correctamente cuando se escribe en el archivo de configuraci\u00f3n de variables."}], "lastModified": "2026-10-24T13:10:00.147", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "901C92C3-006F-4833-8D7E-DFE0B8A9E60E", "versionEndExcluding": "2026.2.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}