Dashboard / CVE-2026-16802

CVE-2026-16802

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 38/100
Published: 2026-07-24 Modified: 2026-10-24 First seen: 2026-10-29 Status: active

Attack Surface

Low Complexity No Interaction Conf. Impact Scope Change

CVSS Vector Breakdown

AV: Local
AC: Low
PR: Low
UI: None
S: Changed
C: High
I: None
A: None

Description

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
devolutions powershell_universal < 2026.2.3.0

References & Advisories (1)

Bug Bounty Relevance

38 / 100
✓ Low complexity
✓ No user interaction

CVSS Score

6.5 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS — Exploitation Probability

0.10%
Raw Score 0.001030
Percentile 1.0%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00103
2026-10-28
0.00103

Intelligence Sources

nvd ref →

External Links