PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-16799 Devolutions CVE debrief

CVE-2026-16799 is an improper access control vulnerability in Devolutions PowerShell Universal 2026.2.2 and earlier. The vulnerability allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties due to missing server-side authorization checks. This issue could potentially allow unauthorized access and modifications, impacting the security of the affected systems.

Vendor
Devolutions
Product
PowerShell Universal
CVSS
MEDIUM 5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-24
Original CVE updated
2026-07-27
Advisory published
2026-07-24
Advisory updated
2026-07-27

Who should care

Users of Devolutions PowerShell Universal 2026.2.2 and earlier should apply patches or mitigations to prevent exploitation of CVE-2026-16799. Additionally, administrators and security teams responsible for managing and securing Devolutions PowerShell Universal deployments should review the vulnerability details and take appropriate actions to protect their environments.

Technical summary

CVE-2026-16799 is an improper access control vulnerability in Devolutions PowerShell Universal 2026.2.2 and earlier. The vulnerability allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties due to missing server-side authorization checks. The CVSS score for this vulnerability is 5, with a severity rating of MEDIUM. This vulnerability could be exploited by an authenticated user with limited privileges, potentially leading to unauthorized access and modifications.

Defensive priority

Apply patches or mitigations to prevent exploitation of CVE-2026-16799. Implement additional access controls to restrict user permissions and monitor systems for suspicious activity.

Recommended defensive actions

  • Apply patches or updates provided by the vendor to address CVE-2026-16799.
  • Implement additional access controls to restrict user permissions.
  • Monitor systems for suspicious activity related to CVE-2026-16799.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-24T15:17:12.857Z and was last modified on 2026-07-27T20:26:57.327Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus and may not reflect the current status. Users should verify the information with the official sources for the most up-to-date details.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-24T15:17:12.857Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.