Authorization Bypass Vulnerability in PowerShell Universal by Ironman Software

CVE-2026-4064

What is CVE-2026-4064?

An authorization bypass vulnerability exists in PowerShell Universal due to missing checks on several gRPC service endpoints. This flaw allows an authenticated user with a valid token to evade role-based access controls, enabling them to execute privileged operations. Potential risks include unauthorized access to sensitive information, creating or deleting resources, and disrupting service operations through specially crafted gRPC requests.

References