Arbitrary Code Execution Vulnerability in Devolutions PowerShell Universal

CVE-2026-129137

What is CVE-2026-129137?

A security configuration weakness in the agent folder of Devolutions PowerShell Universal versions up to 2026.3.4 enables local users without sufficient permissions to execute arbitrary code with SYSTEM privileges. This vulnerability arises from incorrect default permissions, allowing attackers to craft agent configuration files that can point to malicious servers, potentially leading to unauthorized actions and exploitation of vulnerable systems. Organizations using affected versions are encouraged to review their security configurations to mitigate this risk.

References