PatchTheCVECVE-2026-16802: Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2
CVE-2026-16802 is a medium-severity flaw (CVSS 6.5) affecting powershell universal. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.1% (top 99%) |
| CISA exploited list | No |
| Weakness | CWE-312 |
| Published | 2026-07-24 |
| Last modified | 2026-10-24 |
Last updated 2026-10-24 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-16802?
powershell universal: upgrade to 2026.2.3.0. Exact commands for each OS are on this page.
Is CVE-2026-16802 being exploited?
CVE-2026-16802 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-16802 affect?
CVE-2026-16802 affects powershell universal. Severity is medium (CVSS 6.5). Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk
How urgent is CVE-2026-16802?
Priority 23/100. No elevated risk signals yet.
Software pages
PowerShell vulnerabilities · HashiCorp Vault vulnerabilities
Related CVEs
- CVE-2026-16800 HIGH 8.8 UPGRADE Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Un
- CVE-2026-16801 HIGH 8.8 UPGRADE Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell U
- CVE-2026-16798 MEDIUM 6.5 UPGRADE Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Univers
- CVE-2026-16799 MEDIUM 5.0 UPGRADE Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 202