CVE-2026-92237: PowerShell Universal Log File Exposure

CVE-2026-92237 Overview

CVE-2026-92237 is an information disclosure vulnerability in Devolutions PowerShell Universal 2026.2.5 and earlier. The slow query logging feature writes SQL parameter values to the system log when the instance is backed by Microsoft SQL Server. An authenticated user with log read permission can retrieve application tokens, data protection key material, and other stored credentials from these log entries. The flaw is classified as [CWE-532] Insertion of Sensitive Information into Log File.

Critical Impact
Authenticated users holding log read permission can harvest application tokens, data protection keys, and stored credentials, enabling downstream compromise of protected secrets.

Affected Products

Devolutions PowerShell Universal 2026.2.5
Devolutions PowerShell Universal versions prior to 2026.2.5
Deployments backed by Microsoft SQL Server

Discovery Timeline

2026-09-15 - CVE-2026-92237 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92237

Vulnerability Analysis

Devolutions PowerShell Universal includes a slow query logging feature that records database queries exceeding a duration threshold. On instances backed by Microsoft SQL Server, the logging routine includes the values bound to SQL parameters in the emitted log record. Because PowerShell Universal persists sensitive material such as application tokens, data protection key material, and stored credentials in SQL-backed tables, those values pass through parameterized queries and are captured verbatim in the system log.

Any authenticated user granted log read permission can read the log entries. The permission is intended for operational troubleshooting, not for retrieving secret material. The vulnerability elevates a scoped read permission into effective access over the platform's secret store.

Root Cause

The root cause is a violation of secret handling boundaries in the logging pipeline. Parameter values are serialized into log output without redaction, filtering, or classification based on the target table or column sensitivity. The slow query path treats all parameter data as diagnostic content.

Attack Vector

Exploitation requires network access to the PowerShell Universal instance and an authenticated account with log read permission. The attacker triggers or waits for queries that touch tables containing tokens or key material. The attacker then reads the system log through the standard log interface and extracts the parameter values.

No synthetic exploit code is published for this issue. See the Devolutions Security Advisory DEVO-2026-0031 for vendor technical details.

Detection Methods for CVE-2026-92237

Indicators of Compromise

Log read operations from accounts that do not normally consume system logs, particularly high-volume reads following administrative activity.
Presence of long strings resembling tokens, keys, or base64-encoded material within slow query log entries.
Off-hours access to the PowerShell Universal log endpoints by service or automation accounts.

Detection Strategies

Audit role assignments in PowerShell Universal and enumerate every principal holding log read permission.
Review historical slow query logs for parameter values that match token or key patterns and treat any matches as exposed.
Correlate log read events with subsequent use of application tokens or credentials to identify potential secret reuse.

Monitoring Recommendations

Forward PowerShell Universal audit and system logs to a centralized platform for retention and query.
Alert on repeated retrievals of slow query log entries by a single principal within short time windows.
Monitor Microsoft SQL Server for changes to instrumentation and query duration thresholds that could increase log capture volume.

How to Mitigate CVE-2026-92237

Immediate Actions Required

Upgrade Devolutions PowerShell Universal to a version later than 2026.2.5 as published in the vendor advisory.
Revoke log read permission from any account that does not require it for operational duties.
Rotate application tokens, data protection keys, and stored credentials that may have been written to prior slow query logs.

Patch Information

Devolutions has published fixed builds in advisory DEVO-2026-0031. Apply the vendor-supplied release that addresses the slow query logging behavior on Microsoft SQL Server backends. Confirm the running version through the PowerShell Universal administration interface after upgrade.

Workarounds

Disable the slow query logging feature until the patched version is deployed.
Purge historical slow query log content that may contain parameter values from sensitive tables.
Restrict log read permission to a minimal set of administrators and enforce multi-factor authentication on those accounts.

bash

# Configuration example
# Review principals with log read permission and remove where not required
# (Refer to the Devolutions advisory for the exact role names in your version)
Get-PSURole | Where-Object { $_.Permissions -match 'log' }
Revoke-PSURolePermission -Role '<role-name>' -Permission 'LogRead'