CVE-2026-19768: Code Injection
Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with settings management permission to execute arbitrary PowerShell code via a crafted setting value that is not properly escaped when written to the settings configuration file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Devolutions PowerShell Universalto a version that resolves this vulnerability.Fixed in 2026.2.3 - Compensating control
Limit the 'settings management' permission to only trusted/admin users until the affected Devolutions PowerShell Universal version is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-19768?
CVE-2026-19768 has a risk score of 63, indicating it is a significant vulnerability.
How do I fix CVE-2026-19768?
To fix CVE-2026-19768, update Devolutions PowerShell Universal to version 2026.2.4 or later.
Who is affected by CVE-2026-19768?
Authenticated users with settings management permissions in Devolutions PowerShell Universal 2026.2.3 and earlier are affected by CVE-2026-19768.
What type of vulnerability is CVE-2026-19768?
CVE-2026-19768 is categorized as a Code Injection vulnerability.
What action can exploit CVE-2026-19768?
An attacker can exploit CVE-2026-19768 by executing arbitrary PowerShell code through a crafted setting value.