EUVD-2026-58661
GHSA-4xr3-645c-fchw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-accessible settings interface with no interaction required; PR:L for delegatable settings management role; A:L added over the provided A:N since arbitrary code execution inherently enables availability disruption within the platform.
Primary rating from Vendor (devolutions).
CVSS VectorVendor: devolutions
Lifecycle Timeline
5DescriptionCVE.org
Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.
AnalysisAI
Code injection in Devolutions PowerShell Universal 2026.2.3 and earlier allows any authenticated user granted settings management permissions to execute arbitrary PowerShell within the platform runtime. The vulnerability arises because setting values submitted through the settings interface are not properly escaped before being written to the configuration file, which is subsequently parsed and interpreted as executable code. No public exploit code has been identified at time of analysis, and SSVC reports no known active exploitation, but the technical impact is rated total given full arbitrary code execution capability.
Technical ContextAI
Devolutions PowerShell Universal is an enterprise automation and administrative orchestration platform built on PowerShell as its primary scripting runtime. Its settings feature provides a management interface through which authorized users configure platform behavior; those values are serialized into a configuration file that is later read and processed by the platform. CWE-94 (Improper Control of Generation of Code / Code Injection) identifies the root cause class: user-supplied input is embedded into a code or configuration context without adequate escaping or sanitization, causing the PowerShell runtime to interpret injected payloads as executable statements rather than literal data values. This differs from command injection (CWE-78) in that the injected content exploits the PowerShell language parser specifically, not shell metacharacters. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms the attack surface is a network-accessible management interface with no environmental preconditions beyond holding the settings management permission, and the EUVD affected version range 'PowerShell Universal 0 < 2026.2.4' bounds the vulnerable population to all releases through 2026.2.3.
RemediationAI
Upgrade Devolutions PowerShell Universal to version 2026.2.4 or later, which resolves the improper escaping of setting values before they are written to the configuration file, per the vendor advisory at https://devolutions.net/security/advisories/DEVO-2026-0028/. If immediate upgrade is not operationally feasible, restrict the settings management permission to the minimum necessary set of accounts and require multi-factor authentication for all accounts holding this role; this reduces the exploitable surface without eliminating the underlying vulnerability, and carries the trade-off of reduced operational flexibility for delegated administrators. Reviewing the current settings configuration file for unexpected or syntactically anomalous values may help identify signs of prior exploitation. Enabling comprehensive audit logging on all settings-related changes provides ongoing detection coverage for future attempts. A vendor-released patch exists at version 2026.2.4, confirmed by the EUVD affected version range.
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today