CVE-2026-16802 in PowerShell Universal
Summary
by MITRE • 07/24/2026
Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/24/2026
The vulnerability in Devolutions PowerShell Universal 2026.2.2 and earlier versions represents a critical security flaw in how sensitive information is handled within the application's variable storage mechanism. This issue manifests when no vault is selected, causing the system to store secret variables in cleartext format directly on the local file system. The flaw creates an unauthorized access vector that allows local actors with file system privileges to directly read sensitive data without requiring additional authentication or exploitation techniques.
This vulnerability directly maps to CWE-312, which specifically addresses the exposure of sensitive information through cleartext storage. The technical implementation fails to apply proper encryption or obfuscation mechanisms when secret variables are persisted to disk, effectively rendering any confidential data stored in this manner immediately accessible to any entity with read access to the file system. The flaw exists at the application level where it assumes that local file system access is trusted, failing to implement proper security controls for sensitive data handling.
The operational impact of this vulnerability extends beyond simple information disclosure, as it can lead to complete compromise of systems that rely on PowerShell Universal for automation and management tasks. Local actors can extract database credentials, API keys, passwords, and other confidential information that applications depend upon for secure operations. This type of vulnerability is particularly dangerous in enterprise environments where multiple users may have local access to the system, potentially enabling lateral movement and privilege escalation attacks.
The security implications align with several ATT&CK techniques including T1552.001 (Unsecured Credentials) and T1003.008 (OS Credential Dumping), as this vulnerability enables adversaries to obtain sensitive information through direct file system access rather than traditional exploitation methods. Organizations using PowerShell Universal without proper mitigations face significant risk of credential theft, especially when the application runs with elevated privileges or when sensitive variables contain authentication tokens and database connection strings.
Mitigation strategies should include immediate upgrade to version 2026.3.0 or later where this vulnerability has been addressed through proper encryption of secret variables stored on disk. Additionally, system administrators should implement strict file system access controls, regularly audit variable storage locations, and consider implementing automated monitoring for unauthorized access attempts. Organizations should also review their overall security posture to ensure that local file system access is properly restricted and that sensitive data is not unnecessarily exposed in cleartext formats within application configurations or storage mechanisms.