Improper Access Control in Devolutions PowerShell Universal
CVE-2026-8694

5.3MEDIUM

Key Information:

Vendor

Devolutions

Status
Powershell Universal
Vendor
CVE Published:
12 June 2026

What is CVE-2026-8694?

An improper access control vulnerability exists in Devolutions PowerShell Universal versions 2026.1.7 and earlier. This flaw permits an unauthenticated remote attacker to gain access to the OpenAPI specification for user-defined REST endpoints, potentially exposing sensitive information and enabling further attacks. It is crucial for users of affected versions to implement necessary security measures and consider upgrading to secure versions to mitigate the risk.

Affected Version(s)

PowerShell Universal 0 <= 2026.1.7

References

https://devolutions.net/security/advisories/DEVO-2026-0016/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.