CVE-2026-16799 Devolutions CVE debrief

Who should care

Users of Devolutions PowerShell Universal 2026.2.2 and earlier should apply patches or mitigations to prevent exploitation of CVE-2026-16799. Additionally, administrators and security teams responsible for managing and securing Devolutions PowerShell Universal deployments should review the vulnerability details and take appropriate actions to protect their environments.

Technical summary

CVE-2026-16799 is an improper access control vulnerability in Devolutions PowerShell Universal 2026.2.2 and earlier. The vulnerability allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties due to missing server-side authorization checks. The CVSS score for this vulnerability is 5, with a severity rating of MEDIUM. This vulnerability could be exploited by an authenticated user with limited privileges, potentially leading to unauthorized access and modifications.

Defensive priority

Apply patches or mitigations to prevent exploitation of CVE-2026-16799. Implement additional access controls to restrict user permissions and monitor systems for suspicious activity.

Recommended defensive actions

• Apply patches or updates provided by the vendor to address CVE-2026-16799.
• Implement additional access controls to restrict user permissions.
• Monitor systems for suspicious activity related to CVE-2026-16799.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record was published on 2026-07-24T15:17:12.857Z and was last modified on 2026-07-27T20:26:57.327Z. The NVD entry is currently Awaiting Analysis. This information is based on the provided source corpus and may not reflect the current status. Users should verify the information with the official sources for the most up-to-date details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.