CVE-2026-16801 Overview
CVE-2026-16801 is a code injection vulnerability in Devolutions PowerShell Universal version 2026.2.2 and earlier. The flaw resides in the variables feature, where user-supplied variable values are written to the variables configuration file without proper escaping. An authenticated user with variable write permission can craft a variable value that injects arbitrary PowerShell code. When the configuration file is later loaded, the injected code executes within the PowerShell Universal process context. The vulnerability is tracked as CWE-94: Improper Control of Generation of Code.
Critical Impact
An authenticated attacker with variable write privileges can execute arbitrary PowerShell code, resulting in full compromise of confidentiality, integrity, and availability of the PowerShell Universal host.
Affected Products
- Devolutions PowerShell Universal 2026.2.2
- Devolutions PowerShell Universal versions prior to 2026.2.2
- Deployments where variable write permission is delegated to non-administrative users
Discovery Timeline
- 2026-07-24 - CVE-2026-16801 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-16801
Vulnerability Analysis
Devolutions PowerShell Universal exposes a variables feature that allows administrators and delegated users to define reusable values consumed by dashboards, APIs, and automation scripts. The application persists these variables to a configuration file rendered as PowerShell code. When a user submits a variable value, the application fails to escape characters that carry syntactic meaning in PowerShell. An attacker with variable write permission can supply a value containing PowerShell delimiters and statements. The resulting configuration file contains attacker-controlled code that executes the next time the variables file is loaded by the service.
Because PowerShell Universal typically runs with elevated privileges to manage infrastructure and scheduled scripts, code execution through this path grants attackers substantial control over the host and any credentials the service can access.
Root Cause
The root cause is missing input sanitization when serializing variable values into the PowerShell-syntax configuration file. Special characters such as backticks, quotes, dollar signs, and statement terminators are written verbatim rather than escaped or wrapped in a safe literal representation. This turns a data field into an executable code channel, which is the definition of code injection under CWE-94.
Attack Vector
Exploitation requires network access to the PowerShell Universal management interface and an authenticated session with variable write permission. The attacker submits a crafted variable value through the standard variables UI or REST API. The value is written to the variables configuration file with injected PowerShell syntax. On the next load of the variables file, the injected code runs in the security context of the PowerShell Universal service account. See the Devolutions Security Advisory DEVO-2026-0025 for vendor-confirmed details.
No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2026-16801
Indicators of Compromise
- Unexpected modifications to the PowerShell Universal variables configuration file, particularly entries containing embedded PowerShell operators, subexpressions such as $( ), or backtick escape sequences within variable values.
- Child processes spawned by the PowerShell Universal service that do not correspond to defined dashboards, APIs, or scheduled jobs.
- New or modified variables created by non-administrative accounts followed by service restarts or variable reloads.
Detection Strategies
- Audit the variables configuration file for values that contain PowerShell syntax rather than plain literal data.
- Review PowerShell Universal audit logs for variable create and update actions performed by accounts with delegated write permission.
- Enable PowerShell Script Block Logging (Event ID 4104) on the host and inspect script blocks executed by the PowerShell Universal process for unexpected content.
Monitoring Recommendations
- Alert on process creation events where the PowerShell Universal service account launches interpreters, LOLBins, or outbound network utilities.
- Monitor file integrity on the variables configuration file and correlate changes with authenticated user activity.
- Track authentication events for accounts holding variable write permission and flag anomalous source addresses or session times.
How to Mitigate CVE-2026-16801
Immediate Actions Required
- Upgrade Devolutions PowerShell Universal to a version later than 2026.2.2 as directed in the Devolutions Security Advisory DEVO-2026-0025.
- Review all accounts assigned variable write permission and revoke access for users who do not require it.
- Inspect the current variables configuration file for suspicious content before applying the patch, and remove any entries that contain executable PowerShell syntax.
Patch Information
Devolutions has published guidance in advisory DEVO-2026-0025. Administrators should apply the fixed release identified by the vendor and confirm the deployed build is later than 2026.2.2. Refer to the Devolutions Security Advisory DEVO-2026-0025 for the authoritative fixed version list and upgrade instructions.
Workarounds
- Restrict variable write permission to fully trusted administrators until patching is complete.
- Place the PowerShell Universal management interface behind network segmentation or a VPN to limit which authenticated users can reach the variables API.
- Enable comprehensive PowerShell logging and file integrity monitoring on the variables configuration file to detect exploitation attempts during the patch window.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
