Sensitive Information Disclosure in Devolutions PowerShell Universal

CVE-2026-92237

What is CVE-2026-92237?

In the slow query logging feature of Devolutions PowerShell Universal, versions 2026.2.5 and earlier contain a vulnerability that allows authenticated users with log read permissions to inadvertently reveal sensitive information. This includes application tokens, data protection key material, and other stored credentials through SQL parameter values logged in the system log files on instances supported by Microsoft SQL Server. Such exposure can significantly compromise security, making it essential for users to assess and mitigate the risks associated with this vulnerability.

References