Sicurezza & conformità
Manteniamo i più elevati standard per proteggere i suoi dati e garantire la fiducia.
DEVO-2026-0042
PowerShell Universal is affected by multiple vulnerabilities.
Prodotti interessati
Registro delle modifiche
Initial publication - 2026-11-13
Incorrect default permissions on the agent configuration folder
8.5 High - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server.
CVE(s)
CVE-2026-129137
Correzione e soluzioni alternative
Upgrade to PowerShell Universal 2026.3.5 or later.
Incorrect privilege assignment and revocation bypass in app token management
7.7 High - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.
CVE(s)
CVE-2026-102632
Correzione e soluzioni alternative
Upgrade to PowerShell Universal 2026.3.5 or later.