Dashboard / CVE-2026-16799

CVE-2026-16799

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 60/100
Published: 2026-07-24 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Scope Change

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Changed
C: None
I: Low
A: None

Description

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
devolutions powershell_universal < 2026.2.3.0

References & Advisories (1)

Bug Bounty Relevance

60 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

5.0 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

EPSS — Exploitation Probability

0.25%
Raw Score 0.002540
Percentile 17.0%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00254
2026-10-28
0.00254

Intelligence Sources

nvd ref →

External Links