Back to overview

CVE-2026-16800

HIGH
8.8
CVSS 3.1
Description
Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation.

Metadata

CVE ID
CVE-2026-16800
State
PUBLISHED
Assigner
DEVOLUTIONS
Reserved
2026-07-23 19:24 UTC
Published
2026-07-24 14:54 UTC
Last updated
2026-07-24 17:43 UTC
Primary CWE
CWE-94
CWE-94 Improper Control of Generation of Code ('Code Injecti…
Vendor / Product
Devolutions / PowerShell Universal
Sources
cve.org  ·  NVD

Severity & Metrics

8.8 HIGH CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Devolutions PowerShell Universal — 0 < 2026.2.3
Weakness (CWE)
CWESourceDescription
CWE-94 cna CWE-94 Improper Control of Generation of Code ('Code Injection')
CVSS scores (1)
ScoreSeverityVersionSourceVector
8.8 HIGH 3.1 adp CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References (1)
Back to overview