CVE-2026-16802: Medium severity Devolutions PowerShell Universal vulnerability
Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16802?
CVE-2026-16802 has a medium severity rating of 6.5 according to the CVSS 3.1 scoring system.
How do I fix CVE-2026-16802?
To mitigate CVE-2026-16802, avoid using cleartext storage for secret variables and ensure a vault is selected for sensitive information.
What is CVE-2026-16802 about?
CVE-2026-16802 involves the cleartext storage of sensitive information in Devolutions PowerShell Universal, allowing local actors to read secrets if no vault is used.
Who is affected by CVE-2026-16802?
CVE-2026-16802 affects users of Devolutions PowerShell Universal version 2026.2.2 and earlier.
What can an attacker do with CVE-2026-16802?
An attacker with local file system access can read secret values stored in cleartext on disk, potentially compromising sensitive information.