PowerShell Code Injection in Devolutions PowerShell Universal

Executive Summary

This is a code injection vulnerability in Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with schedule creation permission can exploit improper input handling to execute arbitrary PowerShell code by crafting malicious schedule parameter names that get concatenated into a script invocation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, review PowerShell Universal logs for unauthorized schedule creations or modifications. Check for suspicious PowerShell script invocations in schedule parameters. Look for users with schedule creation permissions who are not authorized to execute PowerShell code.

Useful 0 Not Useful 0

Impact Analysis

An attacker with valid credentials and schedule creation rights could run unauthorized PowerShell commands on the affected system. This could lead to data theft, system compromise, privilege escalation, or disruption of services depending on the executed commands.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Devolutions PowerShell Universal to a version later than 2026.2.2. Restrict schedule creation permissions to only trusted users. Audit existing schedules for unauthorized modifications. Disable PowerShell script execution in schedules if not required.

Useful 0 Not Useful 0