01 Record

CVE-2026-19768

Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management

HighPUBLISHEDCNA: DEVOLUTIONS

Base score8.1 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

View raw JSON CVE Program record

02 Description

Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management

03 Metadata

Published: 2026-08-14 13:48Z4 HR AGO
Last updated: 2026-08-14 14:52Z3 HR AGO
Reserved: 2026-08-13
Assigning CNA: DEVOLUTIONS
Record state: PUBLISHED
Severity: High (CVSS 8.1)
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses: CWE-94
SSVC decision: ExploitationnoneAutomatablenoTechnical Impacttotal
Data version: 5.2
Document digest: 018bdc62a981930014cdd43f255e9e14a105cd853c414cec418e77f03e130cbe

04 Affected products

VendorProductVersionsPlatforms

DevolutionsPowerShell Universal0 to < 2026.2.4—

05 References

devolutions.nethttps://devolutions.net/security/advisories/DEVO-2026-0028/

01 Record