---METADATA---
VENDOR: Devolutions
PRODUCT: PowerShell Universal
AFFECTED_VERSIONS: 0 up to (excluding) 2026.2.4
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Devolutions PowerShell Universal contains a code injection vulnerability in the settings feature that can be exploited by authenticated users.

Executive Summary:
Devolutions PowerShell Universal versions prior to 2026.2.4 are vulnerable to code injection, which could lead to unauthorized system command execution.

Vulnerability Details

CVE-ID: CVE-2026-19768

Affected Software: Devolutions PowerShell Universal

Affected Versions: 0 up to (excluding) 2026.2.4

Vulnerability: The application improperly controls the generation of code within its settings feature (CWE-94). An authenticated attacker can inject malicious code, which is then executed by the server with the privileges of the application.

Business Impact

A code injection vulnerability represents a severe threat to the confidentiality, integrity, and availability of the hosting environment. By executing arbitrary code, an attacker could gain full control over the server, access sensitive configuration data, or pivot into the broader network. The CVSS score of 8.1 reflects the high potential for impact on enterprise systems.

Remediation Plan

Immediate Action: Update Devolutions PowerShell Universal to version 2026.2.4 or later immediately.

Proactive Monitoring: Monitor server logs for unexpected process execution or modifications to application configuration files.

Compensating Controls: Ensure the application runs with the least privilege necessary, and utilize a Web Application Firewall to block suspicious input patterns in settings requests.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly dangerous due to the nature of code injection in a powerful tool like PowerShell Universal.

Analyst Recommendation

The risk of code injection in management software is critical. Administrators must verify their current version and apply the vendor-provided update to version 2026.2.4 as soon as possible to prevent potential remote code execution.

---METADATA---
VENDOR: Devolutions
PRODUCT: Server
AFFECTED_VERSIONS: 0 up to (excluding) 2026.1.24, 2026.2.4.0 up to (excluding) 2026.2.14
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Improper access control in the Devolutions Server role management endpoint allows authenticated non-administrative users with specific permissions to escalate privileges to administrator via API requests.

Executive Summary:
An improper access control vulnerability in Devolutions Server allows authenticated users with specific permissions to escalate their privileges to administrator, granting them full control over the application.

Vulnerability Details

CVE-ID: CVE-2026-17568

Affected Software: Devolutions Server

Affected Versions: 0 up to (excluding) 2026.1.24, 2026.2.4.0 up to (excluding) 2026.2.14

Vulnerability: The vulnerability resides in the role membership management endpoint. Authenticated users who hold user-group management permissions can craft malicious API requests to bypass authorization checks and elevate their account status to administrative level.

Business Impact

The ability for a standard user to become an administrator poses a critical threat to the security of the Devolutions Server environment. With a CVSS score of 8.8, this could lead to the total compromise of sensitive stored credentials, unauthorized modification of security policies, and complete control over the managed infrastructure.

Remediation Plan

Immediate Action: Update Devolutions Server to version 2026.1.24 or 2026.2.14, depending on the current branch in use.

Proactive Monitoring: Monitor API logs for suspicious requests targeting the role membership management endpoint, particularly those originating from non-administrative accounts.

Compensating Controls: Restrict access to the API and administrative interfaces to trusted IP ranges until the patch can be applied.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 29, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires a valid, authenticated session, which limits the attack surface to existing users.

Analyst Recommendation

Privilege escalation vulnerabilities in identity and access management tools are exceptionally dangerous. Security teams should expedite the deployment of the provided patches to ensure that administrative access remains protected and limited to authorized personnel.

---METADATA---
VENDOR: Devolutions
PRODUCT: PowerShell Universal
AFFECTED_VERSIONS: 0 up to (excluding) 2026.2.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A code injection vulnerability in the variables feature of Devolutions PowerShell Universal allows authenticated users to execute arbitrary code.

Executive Summary:
A high-severity code injection vulnerability in Devolutions PowerShell Universal allows authenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-16801

Affected Software: Devolutions PowerShell Universal

Affected Versions: 0 up to (excluding) 2026.2.3

Vulnerability: The application fails to properly sanitize input within its variables feature, leading to a CWE-94 code injection vulnerability. This flaw requires the attacker to have low-level authenticated access to the system to successfully execute arbitrary code.

Business Impact

A successful exploit could allow an attacker to execute arbitrary commands with the privileges of the PowerShell Universal service. This could lead to a full compromise of the underlying server, unauthorized access to sensitive automation scripts, and potential lateral movement within the network. With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and availability of critical IT infrastructure.

Remediation Plan

Immediate Action: Update Devolutions PowerShell Universal to version 2026.2.3 or later immediately.

Proactive Monitoring: Review system logs for unusual process execution or PowerShell script modifications. Audit the variables feature for unexpected or unauthorized entries.

Compensating Controls: Restrict access to the PowerShell Universal management interface to trusted internal networks only, and enforce strict principle of least privilege for all user accounts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the nature of code injection, which provides a direct path to full system control for an authenticated user.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Administrators must prioritize patching to version 2026.2.3 to eliminate the risk of remote code execution. Failure to patch leaves the environment vulnerable to internal actors or compromised accounts capable of escalating their privileges to full system control.

---METADATA---
VENDOR: Devolutions
PRODUCT: PowerShell Universal
AFFECTED_VERSIONS: 0 up to (excluding) 2026.2.3
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An authenticated code injection vulnerability in the schedule feature of Devolutions PowerShell Universal allows attackers with lower-level access to execute arbitrary code.

Executive Summary:
An authenticated code injection vulnerability in Devolutions PowerShell Universal versions prior to 2026.2.3 poses a severe risk of arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-16800

Affected Software: Devolutions PowerShell Universal

Affected Versions: 0 up to (excluding) 2026.2.3

Vulnerability: This is a code injection vulnerability (CWE-94) in the schedule feature. The vulnerability requires the attacker to be authenticated with low-level privileges to successfully execute arbitrary code within the application environment.

Business Impact

The CVSS score of 8.8 reflects the high severity of this flaw. By injecting and executing arbitrary code, an attacker could escalate privileges, exfiltrate sensitive data, or gain persistent control over the PowerShell Universal instance, leading to a total breach of the application's integrity and confidentiality.

Remediation Plan

Immediate Action: Upgrade to Devolutions PowerShell Universal version 2026.2.3 or later to remediate the vulnerable scheduling component.

Proactive Monitoring: Audit logs for suspicious activity related to scheduled tasks or unexpected PowerShell process execution initiated by the application service account.

Compensating Controls: Implement strict role-based access control (RBAC) to limit the number of users who can interact with the scheduling features until the patch is applied.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authentication limits the attack surface, but the potential for total system compromise remains high for compromised user accounts.

Analyst Recommendation

This vulnerability represents a significant risk to administrative infrastructure. Immediate patching to version 2026.2.3 is required to eliminate the code injection vector and secure the application environment.

---METADATA---
VENDOR: Devolutions
PRODUCT: Server
AFFECTED_VERSIONS: Devolutions Server 2026.2.4.0 through 2026.2.9.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Devolutions Server 2026.2.4.0 through 2026.2.9.0 fails to enforce mandatory multi-factor authentication (MFA) policies when encountering invalid default values, allowing credentialed bypass.

Executive Summary:
An MFA bypass vulnerability in Devolutions Server allows authenticated users to circumvent mandatory security policies, posing a critical risk to sensitive data access.

Vulnerability Details

CVE-ID: CVE-2026-14536

Affected Software: Devolutions Server

Affected Versions: 2026.2.4.0 through 2026.2.9.0

Vulnerability: This vulnerability involves the improper enforcement of mandatory multi-factor authentication (MFA) policies. An attacker possessing valid user credentials can bypass the MFA requirement when the server encounters an invalid default MFA value, allowing them to authenticate without completing the secondary verification step.

Business Impact

With a CVSS score of 9.8 (Critical), this vulnerability significantly undermines the organization's identity and access management strategy. Successful exploitation allows unauthorized access to sensitive systems protected by Devolutions Server, potentially leading to unauthorized data exposure, system manipulation, or further lateral movement within the network.

Remediation Plan

Immediate Action: Update Devolutions Server to version 2026.2.11.0 or higher immediately.

Proactive Monitoring: Audit user access logs for unusual login patterns, particularly for accounts that should have been subjected to MFA but show successful authentication without it.

Compensating Controls: Enforce strict conditional access policies at the identity provider level (if applicable) and restrict network access to the Devolutions Server instance to authorized IP ranges only.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the critical nature of MFA bypass flaws, the potential for exploitation by malicious actors is high.

Analyst Recommendation

Organizations must prioritize updating to the patched version, 2026.2.11.0, to restore the integrity of their authentication processes. Given the critical impact of bypassing mandatory security controls, this update should be treated as a high-priority maintenance task.

---METADATA---
VENDOR: Devolutions
PRODUCT: Remote Desktop Manager
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
An input validation vulnerability in the SSH Elevate Shell feature of Devolutions Remote Desktop Manager 2026 allows for potential security compromise.

Executive Summary:
Improper input validation in Devolutions Remote Desktop Manager's SSH Elevate Shell feature presents a high-severity risk to administrative sessions.

Vulnerability Details

CVE-ID: CVE-2026-12161

Affected Software: Devolutions Remote Desktop Manager

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability stems from improper input validation within the SSH Elevate Shell component. This allows an attacker to bypass security constraints when initiating elevated shell sessions.

Business Impact

With a CVSS score of 8.8, this vulnerability is critical for environments where administrative access is managed through this software. Exploitation could allow an attacker to gain unauthorized elevated privileges, potentially leading to total control over remote systems managed by the application.

Remediation Plan

Immediate Action: Apply the latest security patches provided by Devolutions to the affected Remote Desktop Manager installation.

Proactive Monitoring: Review audit logs for suspicious SSH shell elevation requests and monitor for unexpected administrative activities.

Compensating Controls: Limit the use of the SSH Elevate Shell feature and enforce the principle of least privilege for accounts using Remote Desktop Manager.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 17, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Because this vulnerability targets an administrative utility, it provides a high-value target for attackers. Users should verify their version against the vendor's security advisory and apply the necessary updates immediately to secure their remote management infrastructure.