Code Injection Vulnerability in Devolutions PowerShell Universal
CVE-2026-16801

Currently unrated

Key Information:

Vendor: Devolutions
Status: Powershell Universal
Vendor: CVE Published:; 24 July 2026

🔔 Create Devolutions Vulnerability Alert

What is CVE-2026-16801?

An improper control of code generation vulnerability exists in Devolutions PowerShell Universal versions 2026.2.2 and earlier. Authenticated users with variable write permissions can manipulate crafted variable values, which are not appropriately escaped when added to the variables configuration file. This flaw can lead to the execution of arbitrary PowerShell code, potentially compromising the integrity of the system.

Affected Version(s)

PowerShell Universal 0 < 2026.2.3

References

https://devolutions.net/security/advisories/DEVO-2026-0025/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Jul 24, 2026
Vulnerability Reserved
Jul 23, 2026

CVE-2026-16801 Data

JSON