PatchTheCVECVE-2026-16799: Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 202
CVE-2026-16799 is a medium-severity flaw (CVSS 5.0) affecting powershell universal. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.0 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 84%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2026-07-24 |
| Last modified | 2026-10-24 |
Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-16799?
powershell universal: upgrade to 2026.2.3.0. Exact commands for each OS are on this page.
Is CVE-2026-16799 being exploited?
CVE-2026-16799 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-16799 affect?
CVE-2026-16799 affects powershell universal. Severity is medium (CVSS 5.0). Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow propertie
How urgent is CVE-2026-16799?
Priority 22/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2026-16800 HIGH 8.8 UPGRADE Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Un
- CVE-2026-16801 HIGH 8.8 UPGRADE Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell U
- CVE-2026-16798 MEDIUM 6.5 UPGRADE Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Univers
- CVE-2026-16802 MEDIUM 6.5 UPGRADE Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2