Cross-Site Scripting Vulnerability in Devolutions PowerShell Universal
CVE-2026-116627

Currently unrated

Key Information:

Vendor: Devolutions
Status: Powershell Universal
Vendor: CVE Published:; 27 October 2026

🔔 Create Devolutions Vulnerability Alert

What is CVE-2026-116627?

An improper neutralization of input during web page generation in the notifications feature of Devolutions PowerShell Universal allows authenticated users with notification creation permissions to execute arbitrary JavaScript on the browsers of other users. A malicious user can exploit this vulnerability by crafting a deceptive notification target URL, potentially leading to unauthorized actions or data exposure within the application.

Affected Version(s)

PowerShell Universal 0 < 2026.3.1

References

https://devolutions.net/security/advisories/DEVO-2026-0038/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 27, 2026
Vulnerability Reserved
Oct 26, 2026

CVE-2026-116627 Data

JSON