Cleartext Storage of Sensitive Data in Devolutions PowerShell Universal

Executive Summary

This vulnerability involves the cleartext storage of sensitive information in the variables feature of Devolutions PowerShell Universal versions 2026.2.2 and earlier. When no vault is selected, secret variables are stored unencrypted on disk, allowing a local attacker with file system access to read these secret values directly.

Useful 0 Not Useful 0

Detection Guidance

Check for files containing secret variables in cleartext within Devolutions PowerShell Universal installation directories. Look for files with sensitive data stored without encryption, especially in variables or configuration files.

Useful 0 Not Useful 0

Impact Analysis

If you use Devolutions PowerShell Universal 2026.2.2 or earlier without a vault, an attacker with local file system access could steal sensitive secrets like passwords or API keys stored as variables. This could lead to unauthorized access to systems, data breaches, or further exploitation of your environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability likely violates compliance requirements for GDPR and HIPAA, which mandate protection of sensitive data. Storing secrets in cleartext fails to meet encryption and access control standards, potentially resulting in regulatory penalties, loss of certification, or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to a version of Devolutions PowerShell Universal that addresses this issue. If upgrading is not possible, ensure all sensitive variables are stored in a secure vault and remove any cleartext storage of secrets.

Useful 0 Not Useful 0