Dashboard / CVE-2026-16800

CVE-2026-16800

HIGH
MEDIUM Priority: 0.05 BB Relevance: 68/100
Published: 2026-07-24 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Network Low Complexity No Interaction Conf. Impact Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: None
S: Unchanged
C: High
I: High
A: High

Description

Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
devolutions powershell_universal < 2026.2.3.0

References & Advisories (1)

Bug Bounty Relevance

68 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

8.8 / 10.0 v3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS — Exploitation Probability

0.53%
Raw Score 0.005300
Percentile 44.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00530
2026-10-28
0.00530

Intelligence Sources

nvd ref →

External Links