CVE-2026-4064: 
Ironman Software PowerShell Universal vulnerability analysis and mitigation

CVE-2026-4064 is a missing authorization vulnerability in Ironman Software's PowerShell Universal that allows authenticated users to bypass role-based access controls (RBAC) via crafted gRPC requests. It affects PowerShell Universal versions 2026.1.0 through 2026.1.3 (all versions before 2026.1.4). The vulnerability was published on March 17, 2026, with a patch released shortly after. It carries a CVSS v3.1 base score of 8.3 (High) (Devolutions Advisory, ENISA EUVD).

The root cause is CWE-862 (Missing Authorization): multiple gRPC service endpoints in PowerShell Universal fail to enforce authorization checks, meaning any authenticated user holding a valid token — regardless of their assigned role — can invoke privileged operations. An attacker sends crafted gRPC requests directly to these unprotected endpoints, bypassing the application's RBAC layer entirely. No special privileges beyond a valid authentication token are required, and no user interaction is needed (Devolutions Advisory, Infinit Security).

Successful exploitation allows any authenticated user to read sensitive data, create or delete resources, and disrupt service operations — actions that should be restricted to privileged roles. The confidentiality and integrity impacts are rated High, with a Low availability impact, reflecting the ability to exfiltrate data and manipulate platform resources such as scripts, dashboards, and APIs managed by PowerShell Universal. In environments where PowerShell Universal is used for IT automation and administration, this could facilitate lateral movement or privilege escalation by enabling low-privileged users to modify automation workflows or access credentials stored within the platform (Devolutions Advisory, ENISA EUVD).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Devolutions Advisory). The EPSS score is approximately 0.038%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the low exploitation barrier — requiring only a valid authentication token — makes it a meaningful risk in multi-tenant or shared PowerShell Universal deployments.

1. Obtain a valid authentication token: Log in to the PowerShell Universal instance with any valid user account (even a low-privileged one) and retrieve an API token via the web UI or API.
2. Identify gRPC endpoints: Enumerate the gRPC service endpoints exposed by the PowerShell Universal server, which typically listens on a configured port (e.g., HTTP/2 over HTTPS).
3. Craft a privileged gRPC request: Using a gRPC client tool (e.g., grpcurl or a custom client), construct a request targeting a privileged operation endpoint — such as resource creation, deletion, or sensitive data retrieval — that would normally require elevated roles.
4. Include the valid token in the request: Attach the authentication token in the request metadata/headers to pass the authentication check while bypassing the missing authorization check.
5. Execute the privileged operation: Send the crafted gRPC request; the server processes it without verifying the caller's role, granting access to the privileged operation and returning sensitive data or confirming resource manipulation (Devolutions Advisory, Infinit Security).

• Network: Unexpected gRPC (HTTP/2) requests to PowerShell Universal service endpoints from user accounts with low-privilege roles; unusual volume of gRPC calls from a single authenticated user token.
• Logs: PowerShell Universal audit logs showing privileged operations (resource creation, deletion, data reads) performed by accounts not assigned administrator or operator roles; API access logs with tokens associated with restricted users invoking admin-level endpoints.
• Behavioral: Low-privileged user accounts accessing or modifying automation scripts, dashboards, APIs, or credentials within PowerShell Universal that are outside their normal scope; unexpected creation or deletion of resources correlated with non-admin user sessions.

The primary remediation is to upgrade PowerShell Universal to version 2026.1.4 or later, which adds the missing authorization checks to the affected gRPC endpoints (Devolutions Advisory). As an interim measure, administrators should restrict network access to the PowerShell Universal gRPC service to trusted users and networks only, and audit existing API tokens to revoke any that are unnecessary or belong to low-privileged accounts. Review gRPC endpoint access logs for any suspicious activity from authenticated users attempting unauthorized operations prior to patching.

The vulnerability was assigned by Devolutions and disclosed via their security advisory portal on March 17, 2026. It received coverage from automated vulnerability tracking services including CVEFeed, VulDB, and Radar by Offseq shortly after publication (ENISA EUVD). A brief technical write-up was published by Infinit Security (Infinit Security). No significant broader media coverage or notable researcher commentary beyond routine tracking has been observed.