CVE-2026-16801 Devolutions CVE debrief

Who should care

Administrators and users of Devolutions PowerShell Universal 2026.2.2 and earlier should be aware of this vulnerability and take necessary actions to mitigate it. This includes applying patches or updates, restricting variable write permissions, and monitoring for suspicious activity.

Technical summary

The vulnerability is caused by improper control of generation of code, also known as code injection, in the variables feature of Devolutions PowerShell Universal. An authenticated user with variable write permission can execute arbitrary PowerShell code by crafting a variable value that is not properly escaped when written to the variables configuration file. This allows for arbitrary code execution, which can lead to a high impact on the system.

Defensive priority

High priority should be given to patching or mitigating this vulnerability, as it allows for arbitrary code execution.

Recommended defensive actions

• Apply the patch or update to a version that fixes this vulnerability.
• Restrict variable write permissions to only necessary users.
• Monitor for suspicious activity in the variables configuration file.
• Consider implementing additional security controls, such as input validation and sanitization.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-24T15:17:13.077Z and was last modified on 2026-07-27T20:26:57.327Z. The NVD entry is currently Awaiting Analysis. This vulnerability affects Devolutions PowerShell Universal 2026.2.2 and earlier, allowing authenticated users with variable write permission to execute arbitrary PowerShell code via a crafted variable value. Evidence is limited, and defenders should verify the affected scope and vendor guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.