CVE-2026-16800 in PowerShell Universal
Summary
by MITRE • 07/24/2026
Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability represents a critical code injection flaw within Devolutions PowerShell Universal's scheduling functionality that enables authenticated attackers to execute arbitrary PowerShell commands through manipulated schedule parameter names. The issue stems from insufficient input validation and sanitization mechanisms when processing schedule parameters, allowing maliciously crafted inputs to be directly incorporated into script execution contexts without proper isolation or escaping.
The technical exploitation occurs when an authenticated user with schedule creation privileges crafts specific parameter names that contain PowerShell command injection payloads. These parameters are then concatenated into script invocation constructs without adequate sanitization, creating a path for arbitrary code execution within the PowerShell environment. This weakness aligns with CWE-94, which describes improper control of generation of code, and specifically manifests as a code injection vulnerability in the context of scheduled task processing.
The operational impact of this vulnerability is severe as it provides attackers with a direct pathway to execute malicious PowerShell commands on systems running affected versions of PowerShell Universal. An attacker could potentially escalate privileges, access sensitive data, establish persistence mechanisms, or deploy additional malware through the compromised scheduling functionality. The vulnerability affects all authenticated users who possess schedule creation permissions, making it particularly dangerous in environments where multiple users have administrative or privileged access levels.
Security controls and mitigation strategies should focus on implementing strict input validation and sanitization for all schedule parameter names, including the implementation of proper escaping mechanisms when incorporating user-supplied data into script contexts. Organizations should immediately upgrade to patched versions of PowerShell Universal, enforce principle of least privilege for schedule creation permissions, and implement monitoring solutions to detect suspicious scheduling activities. The vulnerability demonstrates the importance of secure coding practices in automation frameworks and aligns with ATT&CK technique T1059.001 for execution through PowerShell command line interfaces.
Additional defensive measures include implementing web application firewalls to filter malicious payloads, conducting regular security assessments of automation components, and ensuring proper input validation at multiple layers of the application architecture. The vulnerability highlights the critical need for comprehensive testing of automated scheduling features and proper separation of user input from executable code contexts in enterprise automation platforms. Organizations should also consider implementing privileged access management solutions to limit who can create or modify scheduled tasks within their PowerShell Universal environments, reducing the attack surface for such code injection vulnerabilities.