EUVD-2026-48607
GHSA-7qq8-3vqq-3796
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Low-privilege schedule creation role needed (PR:L); injection via parameter concatenation is trivial (AC:L); no user interaction required after schedule creation.
Primary rating from Vendor (DEVOLUTIONS).
CVSS VectorVendor: DEVOLUTIONS
Lifecycle Timeline
5DescriptionCVE.org
Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation.
AnalysisAI
Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%).
Technical ContextAI
The vulnerability resides in the schedule feature of PowerShell Universal, a web-based IT automation platform. The CWE-94 code injection occurs because user-supplied parameter names are dynamically inserted into PowerShell scripts without proper sanitization or encoding. The CPE designation cpe:2.3:a:devolutions:powershell_universal:*:*:*:*:*:*:*:* confirms the affected component is the PowerShell Universal application itself.
RemediationAI
Upgrade to PowerShell Universal 2026.2.3 or later immediately. This version removes the code injection vector. The official advisory at https://devolutions.net/security/advisories/DEVO-2026-0025/ documents the fix. If an immediate upgrade is not possible, restrict schedule creation privileges to only trusted administrators; note, however, that this reduces but does not eliminate the risk, as malicious schedule parameters could still be injected by any user retaining that permission. There is no workaround that fully mitigates the injection, so patching remains the definitive action.
More in Powershell Universal
View allThe API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary comman
Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute
Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with
PowerShell Universal before version 2026.1.4 contains insufficient authorization validation on gRPC endpoints, allowing
The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the conf
Devolutions PowerShell Universal 2026.2.0 leaks serialized App Tokens in plaintext within AI Agent job API responses, en
OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with
Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system
authentication configuration in PowerShell Universal versions up to 2026.1.3 is affected by cleartext storage of sensit
PowerShell Universal versions before 4.5.6 and 5.6.13 contain a stored cross-site scripting vulnerability that allows un
PowerShell Universal versions before 2026.1.4 contain an improper input validation vulnerability in the apps and endpoin
Unauthenticated remote access to user-defined REST endpoint OpenAPI specifications is possible in Devolutions PowerShell
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today