CVE-2026-16800 Overview
CVE-2026-16800 is a code injection vulnerability in Devolutions PowerShell Universal 2026.2.2 and earlier. The flaw resides in the schedule feature, which concatenates user-supplied parameter names into a PowerShell script invocation without proper sanitization. An authenticated user with schedule creation permission can craft parameter names that break out of the intended context and execute arbitrary PowerShell code on the server. The vulnerability is tracked under CWE-94: Improper Control of Generation of Code.
Critical Impact
Authenticated attackers with schedule creation permission can execute arbitrary PowerShell code on the host, leading to full compromise of confidentiality, integrity, and availability.
Affected Products
- Devolutions PowerShell Universal 2026.2.2 and earlier
- Deployments exposing the schedule feature to authenticated users
- Environments granting schedule creation permission to non-administrative roles
Discovery Timeline
- 2026-07-24 - CVE-2026-16800 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-16800
Vulnerability Analysis
The vulnerability exists in how PowerShell Universal builds the script invocation for scheduled tasks. Parameter names supplied through the schedule feature are inserted directly into the invocation string. This string is then evaluated by the PowerShell runtime, which treats crafted names as executable syntax rather than inert identifiers.
An attacker who can create or edit schedules provides a parameter name containing PowerShell operators, subexpressions, or command separators. When the schedule runs, the injected fragment executes with the privileges of the PowerShell Universal service account. This typically enables lateral movement, credential access, and persistence on the host.
Root Cause
The root cause is unsafe string concatenation of untrusted input into code that is later interpreted. The schedule feature does not treat parameter names as data. It embeds them into the invocation, violating the separation between code and data required by [CWE-94].
Attack Vector
Exploitation requires network access to the PowerShell Universal web interface or API and authenticated credentials with schedule creation permission. The attacker submits a schedule containing a malicious parameter name. Triggering the schedule executes the injected PowerShell code within the server process context. No user interaction is required beyond the attacker's own actions.
No public proof-of-concept is available. See the Devolutions Security Advisory DEVO-2026-0025 for vendor technical details.
Detection Methods for CVE-2026-16800
Indicators of Compromise
- Schedule definitions containing parameter names with characters such as $(, backticks, semicolons, or pipe operators.
- Unexpected child processes spawned by the PowerShell Universal service, including powershell.exe, pwsh.exe, cmd.exe, or scripting hosts.
- Outbound network connections initiated by the PowerShell Universal host to unfamiliar destinations following schedule execution.
Detection Strategies
- Audit the PowerShell Universal database and configuration exports for schedules whose parameter names contain non-alphanumeric syntax.
- Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging on hosts running PowerShell Universal to capture invocation payloads.
- Correlate schedule execution timestamps with process creation events (Sysmon Event ID 1 or Windows Event ID 4688) to identify unexpected command lines.
Monitoring Recommendations
- Alert on new or modified schedules created by non-administrative accounts.
- Monitor authentication logs for accounts holding schedule creation permission and investigate anomalous session activity.
- Track file system and registry writes performed under the PowerShell Universal service identity for signs of persistence.
How to Mitigate CVE-2026-16800
Immediate Actions Required
- Upgrade Devolutions PowerShell Universal to a version later than 2026.2.2 per the vendor advisory.
- Review all accounts assigned schedule creation permission and remove access that is not required for operations.
- Audit existing schedules for suspicious parameter names and remove or sanitize any that contain PowerShell metacharacters.
Patch Information
Devolutions has published guidance in Devolutions Security Advisory DEVO-2026-0025. Administrators should apply the fixed release referenced in the advisory to versions 2026.2.2 and earlier. Restart the PowerShell Universal service after upgrading and verify the installed version.
Workarounds
- Restrict schedule creation permission to trusted administrators until the patch is applied.
- Run the PowerShell Universal service under a least-privileged account to limit the blast radius of injected code.
- Isolate the PowerShell Universal host on a segmented management network with strict egress filtering.
# Verify installed PowerShell Universal version on Windows
Get-ItemProperty "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*" |
Where-Object { $_.DisplayName -like "*PowerShell Universal*" } |
Select-Object DisplayName, DisplayVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
