CVE-2026-92237 in PowerShell Universal
Summary
by MITRE • 09/16/2026
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL parameter values written to the system log on instances backed by Microsoft SQL Server.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The vulnerability identified in Devolutions PowerShell Universal versions 2026.2.5 and earlier represents a critical failure in input sanitization within the slow query logging mechanism, specifically affecting deployments that utilize Microsoft SQL Server as their backend database. This flaw allows an authenticated user who possesses log read permissions to extract sensitive application tokens, data protection key material, and other stored credentials. The root cause lies in how the system handles SQL parameter values during the execution of long-running queries. When a query exceeds the configured threshold for slow logging, the database engine records details about the statement into a dedicated log file or table. In this specific implementation, the application fails to mask or sanitize sensitive data embedded within these parameters before they are persisted in the logs. Consequently, any information passed as part of the SQL command structure that contains secrets is written verbatim to the slow query log without obfuscation.
From a technical perspective, this issue stems from an improper handling of user-supplied input during database interaction routines. While many modern frameworks attempt to abstract away direct SQL construction by using parameterized queries to prevent injection attacks, they do not always ensure that the values themselves are scrubbed before being logged for diagnostic purposes. In the context of PowerShell Universal, which serves as a platform for automating administrative tasks and managing secrets, the presence of plaintext credentials in log files creates a significant attack vector. An attacker with access to these logs can parse the entries to identify patterns associated with authentication tokens or encryption keys. Since slow query logs are often retained for extended periods and may be accessible by various support personnel or automated monitoring tools, the exposure window is substantial. The vulnerability effectively bypasses standard access controls because it relies on legitimate log reading privileges rather than exploiting a privilege escalation flaw in the application logic itself.
The operational impact of this vulnerability is severe due to the nature of the data exposed. Application tokens obtained through this method can be used by an attacker to impersonate valid users or services, potentially leading to unauthorized access to connected systems and resources managed by PowerShell Universal. Data protection key material is particularly critical as it serves as the foundation for encrypting sensitive information within the application; compromising these keys could allow decryption of other stored secrets that are not directly visible in the logs but rely on this cryptographic infrastructure. Furthermore, direct exposure of stored credentials enables lateral movement across environments where those same passwords or API keys are reused. This aligns with common threat models involving credential harvesting and subsequent privilege escalation within enterprise IT ecosystems.
This vulnerability maps to CWE-532, which covers information exposure through log files, a category that highlights the risk of storing sensitive data in plaintext logs accessible to unauthorized parties. Additionally, it relates to CWE-798, concerning the use of hardcoded credentials or secrets, although here the issue is more about improper sanitization rather than hardcoding per se. In terms of offensive security frameworks, this behavior facilitates techniques associated with ATT&CK T1005, which describes data from local system retrieval via log files. Attackers often target these logs because they are frequently less secured than application databases and may be copied to external storage for analysis, increasing the blast radius of the compromise.
Mitigation strategies should focus on immediate remediation by upgrading to a patched version of Devolutions PowerShell Universal where this logging behavior has been corrected. Until an update is applied, administrators can implement compensating controls such as restricting log file permissions so that only highly privileged service accounts or specific security auditors with strict need-to-know justification can access them. Implementing regular rotation and secure archival practices for slow query logs reduces the window of exposure. Additionally, organizations should review their logging configurations to ensure that no sensitive parameters are passed in a manner that triggers this logging path without prior sanitization. It is also advisable to audit existing log files for any previously captured secrets and rotate those credentials immediately if they were exposed during the vulnerable period.