Devolutions PowerShell Universal EUVD-2026-48609

The variables feature must be used for storing secrets, and no vault must be selected - when a vault is configured, secrets are encrypted and not exposed. Exploitation requires local file system access with low privileges (PR:L) as defined in the CVSS vector; remote or unauthenticated exploitation is not possible. The attacker must be able to read the directory where PowerShell Universal stores variable data, typically accessible only to local users on the host.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) indicates a local attack vector with low complexity and low privileges required, resulting in high confidentiality impact on a subsequent system. EPSS probability is extremely low (0.08%, 0th percentile), suggesting that exploitation in the wild is highly unlikely. SSVC decision framework rates exploitation as 'none', automatable as 'no', and technical impact as 'partial'. No CISA KEV listing and no public exploit code have been identified. The primary risk factor is the prerequisite of local file system access, which significantly limits remote attack scenarios. Overall, this vulnerability presents a low real-world risk despite a CVSS base score of 6.5.

A low-privileged local user navigates to the PowerShell Universal data directory on the server and locates files containing secret variable values stored in cleartext. The attacker simply reads the files to obtain passwords, API keys, or other sensitive information. No publicly available exploit code has been identified, but the attack requires only basic file system access.