PatchTheCVECVE-2026-16798: Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Univers
CVE-2026-16798 is a medium-severity flaw (CVSS 6.5) affecting powershell universal. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.4% (top 69%) |
| CISA exploited list | No |
| Weakness | CWE-201 |
| Published | 2026-07-24 |
| Last modified | 2026-10-24 |
Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-16798?
powershell universal: upgrade to 2026.2.3.0. Exact commands for each OS are on this page.
Is CVE-2026-16798 being exploited?
CVE-2026-16798 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-16798 affect?
CVE-2026-16798 affects powershell universal. Severity is medium (CVSS 6.5). Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAu
How urgent is CVE-2026-16798?
Priority 30/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-16800 HIGH 8.8 UPGRADE Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Un
- CVE-2026-16801 HIGH 8.8 UPGRADE Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell U
- CVE-2026-16802 MEDIUM 6.5 UPGRADE Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2
- CVE-2026-16799 MEDIUM 5.0 UPGRADE Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 202