CVE-2026-92237: Devolutions PowerShell Universal vulnerability

Q: Which deployments are exposed?

The issue affects Devolutions PowerShell Universal 2026.2.5 and earlier when the instance is backed by Microsoft SQL Server and uses the slow query logging feature.

Q: What access does an attacker need?

An attacker must be authenticated and have permission to read logs. They can obtain sensitive values when SQL parameter values are written to the system log.

Q: What sensitive information could be disclosed?

Exposed log entries may include application tokens, data protection key material, and other stored credentials.

Published Sep 15, 2026

Updated

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL parameter values written to the system log on instances backed by Microsoft SQL Server.

Affected Software

1 affected component

Devolutions PowerShell Universal<=2026.2.5

Event History

Sep 15, 2026

CVE Published

via MITRE·08:14 PM

Data Sourced

via MITRE·08:14 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed?

The issue affects Devolutions PowerShell Universal 2026.2.5 and earlier when the instance is backed by Microsoft SQL Server and uses the slow query logging feature.

What access does an attacker need?

An attacker must be authenticated and have permission to read logs. They can obtain sensitive values when SQL parameter values are written to the system log.

What sensitive information could be disclosed?

Exposed log entries may include application tokens, data protection key material, and other stored credentials.