EUVD-2026-58661
GHSA-4xr3-645c-fchw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible settings interface with no interaction required; PR:L for delegatable settings management role; A:L added over the provided A:N since arbitrary code execution inherently enables availability disruption within the platform.
Primary rating from Vendor (devolutions).
CVSS VectorVendor: devolutions
Lifecycle Timeline
5DescriptionCVE.org
Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.
AnalysisAI
Code injection in Devolutions PowerShell Universal 2026.2.3 and earlier allows any authenticated user granted settings management permissions to execute arbitrary PowerShell within the platform runtime. The vulnerability arises because setting values submitted through the settings interface are not properly escaped before being written to the configuration file, which is subsequently parsed and interpreted as executable code. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated session with the specific settings management permission explicitly assigned in PowerShell Universal - this is not a baseline authenticated-user privilege but an administrative delegation that must be deliberately granted. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 score reflects a network-accessible, low-complexity attack with low privilege requirements and high confidentiality and integrity impact, which on the surface suggests broad urgency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Devolutions PowerShell Universal to version 2026.2.4 or later, which resolves the improper escaping of setting values before they are written to the configuration file, per the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0028/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Devolutions PowerShell Universal versions 2026.2.3 or earlier and audit which users hold settings management permissions; obtain the latest patched version from Devolutions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today