CVE-2026-16801 in PowerShell Universal
Summary
by MITRE • 07/24/2026
Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability represents a critical code injection flaw within Devolutions PowerShell Universal platform that enables authenticated attackers with variable write permissions to execute arbitrary PowerShell commands. The issue stems from inadequate input validation and sanitization mechanisms in the variables feature where user-supplied values are directly written to configuration files without proper escaping or encoding. When an attacker crafts malicious variable values containing PowerShell command sequences, these inputs are persisted in the configuration file and subsequently executed by the system during variable processing operations.
The technical exploitation occurs through the improper handling of user input within the variable management subsystem where the application fails to implement proper security controls such as input sanitization, output encoding, or proper escaping mechanisms. This weakness allows attackers to inject malicious PowerShell commands that are then interpreted and executed by the underlying PowerShell engine when variables are processed or referenced. The vulnerability is particularly dangerous because it leverages legitimate write permissions within the system, making detection more challenging and allowing attackers to operate under seemingly normal user privileges.
From an operational impact perspective, this code injection vulnerability can lead to complete system compromise as attackers can execute arbitrary commands with the privileges of the PowerShell Universal service account. The attack surface extends beyond simple command execution to include potential lateral movement within networks, data exfiltration, privilege escalation, and persistence mechanisms. Security professionals should note that this vulnerability aligns with CWE-94, which specifically addresses "Improper Control of Generation of Code," and maps to ATT&CK techniques such as T1059.001 for command and scripting interpreter and T1068 for exploit for privilege escalation.
The mitigation strategy requires implementing proper input validation and sanitization measures at multiple layers including immediate remediation of the variable handling code to properly escape or encode user inputs before writing them to configuration files. Organizations should also implement principle of least privilege controls to limit write permissions on variable configurations, deploy runtime application self-protection mechanisms, and consider implementing automated code review processes to identify similar vulnerabilities in other system components. Additionally, monitoring should be enhanced to detect unusual patterns in variable modification activities that could indicate exploitation attempts, while regular security updates and patch management procedures should be enforced across all instances of PowerShell Universal to prevent further exploitation of this vulnerability.