CVE-2026-16799

🔶 medium

Summary

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.

CVSS Score

5.0

Medium

EPSS Score

0.2

Exploit Probability

Published Date

2026-07-24

First Seen: 2026-07-31

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 19.0% of all 340,405 vulnerabilities in our database.

#275,600

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jul 24, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-07-29

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

CWE IDs (Weakness Types)

CWE-862

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
devolutions	powershell_universal	Affected	< 2026.2.3.0

🔗 References 1

https://devolutions.net/security/advisories/DEVO-202...

Vendor Advisory

🔗 Related CVEs 5

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-16798	🔶 medium	6.5	0.2	Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2....	2026-07-24
CVE-2026-16800	⚠️ high	8.8	0.3	Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 20...	2026-07-24
CVE-2026-16801	⚠️ high	8.8	0.3	Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2...	2026-07-24
CVE-2026-16802	🔶 medium	6.5	0.1	Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and ear...	2026-07-24
CVE-2026-13437	🔶 medium	6.5	0.3	Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 a...	2026-06-29

These CVEs affect the same products