Security & compliance
Upholding the highest standards to protect your data and ensure trust.
DEVO-2026-0042
PowerShell Universal is affected by multiple vulnerabilities.
Affected Products
Change Log
Initial publication - 2026-11-13
Incorrect default permissions on the agent configuration folder
8.5 High - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server.
CVE(s)
CVE-2026-129137
Remediation and Workarounds
Upgrade to PowerShell Universal 2026.3.5 or later.
Incorrect privilege assignment and revocation bypass in app token management
7.7 High - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and earlier allows an authenticated user with token creation or update permissions to escalate privileges to administrator, and allows a revoked app token to be reinstated in multi-node deployments, via crafted app token requests that set an arbitrary role or revocation state.
CVE(s)
CVE-2026-102632
Remediation and Workarounds
Upgrade to PowerShell Universal 2026.3.5 or later.