CVE-2026-16802 Overview
CVE-2026-16802 is a cleartext storage vulnerability in Devolutions PowerShell Universal 2026.2.2 and earlier. The variables feature stores secret values on disk in cleartext when no vault is selected. A local actor with file system access can read these secrets directly from disk.
The issue is tracked under [CWE-312: Cleartext Storage of Sensitive Information]. Devolutions published advisory DEVO-2026-0025 documenting the flaw. No public exploit or proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Critical Impact
A local authenticated actor with file system access can extract secrets from PowerShell Universal variables, exposing credentials, API keys, and other sensitive data used to authenticate to downstream systems.
Affected Products
- Devolutions PowerShell Universal 2026.2.2
- Devolutions PowerShell Universal versions prior to 2026.2.2
- Deployments configured with secret variables without an assigned vault
Discovery Timeline
- 2026-07-24 - CVE-2026-16802 published to NVD
- 2026-07-29 - Last updated in NVD database
Technical Details for CVE-2026-16802
Vulnerability Analysis
Devolutions PowerShell Universal supports secret variables that hold sensitive values such as credentials, tokens, and connection strings. Administrators can bind secret variables to a vault provider that encrypts values at rest. When no vault is selected during variable creation, the product persists the secret to disk without encryption.
Any local process or user with read access to the affected files can retrieve the plaintext values. The impact scope extends beyond the process boundary because the exposed secrets typically authenticate to other systems. This matches the CVSS scope change (S:C) reflected in the vector.
The vulnerability affects confidentiality only. Integrity and availability of the PowerShell Universal service are not directly impacted by the flaw itself. However, disclosed credentials can be reused by an attacker to compromise integrity or availability of connected systems.
Root Cause
The root cause is missing at-rest encryption for the default storage path when no vault is bound to a secret variable [CWE-312]. The product treats the "no vault" configuration as valid and writes the value verbatim rather than rejecting the operation or applying a default encryption provider.
Attack Vector
Exploitation requires local access with the ability to read files owned by the PowerShell Universal service. An attacker with a low-privileged shell, a compromised backup, or access to a filesystem snapshot can enumerate the variables store and extract cleartext secrets. No user interaction is required.
Since no verified proof-of-concept is available, refer to the Devolutions Security Advisory DEVO-2026-0025 for vendor-provided technical details.
Detection Methods for CVE-2026-16802
Indicators of Compromise
- Read access events on PowerShell Universal configuration and variable storage files originating from unexpected user accounts or processes.
- Presence of secret variables in the environment whose vault binding is null or empty.
- Copies of PowerShell Universal data directories in backups, archives, or user home directories outside the expected service path.
Detection Strategies
- Inventory all PowerShell Universal secret variables and flag any entries stored without a configured vault provider.
- Audit file system access logs for the PowerShell Universal data directory and alert on reads by non-service accounts.
- Correlate authentication anomalies on downstream systems with hosts running vulnerable PowerShell Universal versions.
Monitoring Recommendations
- Enable object-access auditing on the PowerShell Universal installation and data directories on Windows hosts.
- Monitor for administrative changes to the variables feature, particularly creation or modification of variables lacking a vault binding.
- Track privileged local logons on hosts running PowerShell Universal and review historical access to the variable store.
How to Mitigate CVE-2026-16802
Immediate Actions Required
- Upgrade Devolutions PowerShell Universal to a fixed release after 2026.2.2 as documented in DEVO-2026-0025.
- Rotate every secret that was stored in a variable without a vault binding, including credentials, API keys, and tokens.
- Restrict file system permissions on the PowerShell Universal data directory to the service account only.
Patch Information
Devolutions addressed the issue in releases following PowerShell Universal 2026.2.2. Consult the Devolutions Security Advisory DEVO-2026-0025 for the specific fixed version and upgrade instructions.
Workarounds
- Configure a vault provider for every secret variable and migrate existing plaintext secrets into the vault.
- Remove any secret variables that do not have a vault binding until upgrade is complete.
- Limit local and administrative access to the PowerShell Universal host and store backups on encrypted, access-controlled media.
# Configuration example
# Refer to the Devolutions advisory for vendor-supported remediation steps:
# https://devolutions.net/security/advisories/DEVO-2026-0025/
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
