Sicherheit & Compliance
Höchste Standards zum Schutz Ihrer Daten und zur Gewährleistung von Vertrauen.
DEVO-2026-0042
PowerShell Universal is affected by multiple vulnerabilities.
Betroffene Produkte
Änderungsprotokoll
Initial publication - 2026-11-13
Incorrect default permissions on the agent configuration folder
8.5 High - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server.
CVE(s)
CVE-2026-129137
Behebung und Workarounds
Upgrade to PowerShell Universal 2026.3.5 or later.
Incorrect privilege assignment and revocation bypass in app token management
7.7 High - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.
CVE(s)
CVE-2026-102632
Behebung und Workarounds
Upgrade to PowerShell Universal 2026.3.5 or later.