CVE-2026-19768: 
Ironman Software PowerShell Universal vulnerability analysis and mitigation

CVE-2026-19768 is a code injection vulnerability (CWE-94) in the settings feature of Devolutions PowerShell Universal that allows an authenticated user with settings management permission to execute arbitrary PowerShell code. The flaw exists in versions 2026.2.3 and earlier, with version 2026.2.4 containing the fix. It was published on August 14, 2026, with Devolutions issuing advisory DEVO-2026-0028. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Devolutions Advisory).

The root cause is improper neutralization of user-supplied input when crafted setting values are written to the settings configuration file (CWE-94: Improper Control of Generation of Code). When an authenticated user with settings management permission submits a malicious setting value containing PowerShell code, the application fails to properly escape or sanitize the input before writing it to the configuration file, which is subsequently interpreted and executed as PowerShell code. The attack vector is network-based, requires low privileges (settings management permission), and no user interaction, making it straightforward to exploit for any user holding the relevant role (GitHub Advisory, Devolutions Advisory).

Successful exploitation allows an authenticated attacker to execute arbitrary PowerShell code in the context of the Devolutions PowerShell Universal service, resulting in high confidentiality and high integrity impact on the affected system. An attacker could read sensitive data, modify system configurations, establish persistence, or pivot to other systems accessible from the server. Availability is not directly impacted per the CVSS assessment, but the ability to run arbitrary code effectively grants full control over the host environment (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The NVD SSVC assessment classifies exploitation as "none" and the vulnerability as not automatable, reflecting the requirement for authenticated access with specific permissions. The EPSS score is approximately 0.278% (20th percentile), indicating a low near-term probability of exploitation. No threat actor attribution or CISA KEV catalog listing has been identified for this CVE.

1. Reconnaissance: Identify a Devolutions PowerShell Universal instance running version 2026.2.3 or earlier, accessible over the network.
2. Obtain credentials: Acquire credentials for an account with settings management permission — either through phishing, credential reuse, or insider access.
3. Access the settings feature: Authenticate to the PowerShell Universal web interface and navigate to the settings management section.
4. Craft malicious setting value: Prepare a setting value containing embedded PowerShell code (e.g., a reverse shell payload or data exfiltration command) that exploits the lack of escaping when written to the configuration file.
5. Submit the crafted value: Save the malicious setting value through the UI or API, causing it to be written unescaped into the settings configuration file.
6. Trigger execution: The injected PowerShell code is executed by the application when the configuration file is read or processed, achieving arbitrary code execution on the server (GitHub Advisory, Devolutions Advisory).

• Logs: Unexpected or anomalous PowerShell commands appearing in PowerShell Universal application logs or Windows PowerShell event logs (Event IDs 4103, 4104) originating from the service account.
• File System: Unusual modifications to the PowerShell Universal settings configuration file with embedded script-like content or special characters not typical of normal configuration values.
• Process: Unexpected child processes spawned by the PowerShell Universal service process (e.g., powershell.exe, cmd.exe, net.exe, curl.exe) performing network connections or file operations.
• Network: Outbound connections from the PowerShell Universal server to unknown external IP addresses or C2 infrastructure, particularly initiated by the service process.

Devolutions has released version 2026.2.4 of PowerShell Universal, which addresses this vulnerability; users should upgrade immediately (Devolutions Advisory). As a compensating control, restrict settings management permissions to the minimum number of trusted administrators necessary. Additionally, implement network-level access controls to limit who can reach the PowerShell Universal management interface, and audit existing accounts holding settings management roles for any signs of unauthorized access.