CVE-2026-16802

Executive Summary

CVE-2026-16802 exposes a cleartext storage vulnerability in Devolutions PowerShell Universal (versions 2026.2.2 and earlier). Secret variables are written to disk unencrypted when no vault is selected, allowing any local actor with filesystem access to read sensitive data (API keys, passwords, tokens). The vulnerability requires local access but can be chained with other attacks (e.g., RCE or physical access). No CVSS vector was assigned, but the impact on confidentiality is high. No public exploit or patch exists at this time, but a workaround is available: always configure a vault.

Since the vulnerable component is a desktop/server application, not a package from NPM/PyPI/Go/Ruby, the Supply Chain & Package Security section is omitted.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (not officially calculated; estimated based on CVSS:3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N → Base Score: 6.2 (Medium))
• Attack Vector: Local (requires filesystem access)
• Attack Complexity: Low
• Privileges Required: Low (must be a local user on the machine)
• User Interaction: None
• Scope: Unchanged
• Confidentiality: High
• Integrity: None
• Availability: None
• Threat Level: Medium (due to local prerequisite)

Deep Dive & Mechanics

The vulnerability resides in the variables feature of Devolutions PowerShell Universal. When a user defines a secret variable (marked as sensitive), the application should encrypt it before writing to disk. However, if no external vault (e.g., Devolutions Server, Azure Key Vault, HashiCorp Vault) is configured, the variable is stored in cleartext within a JSON or XML configuration file. The exact file location is typically:

• %ProgramData%\Devolutions\PowerShellUniversal\**\variables.json
• ~/.PowerShellUniversal/variables.json

The cleartext storage occurs because the encryption fallback is disabled when no vault is present. Internally, the code path for VaultManager.SetSecret() does not call an encryption wrapper if vaultProvider == null.

Attackers who have read access to the filesystem (e.g., through a malicious insider, a secondary exploit, or physical access) can directly extract secrets. The vulnerability does not require elevated privileges beyond the ability to read the target file.

Vulnerable vs. Patched Code

No official patch has been released. The fix would involve:

• Vulnerable:

  public void SetSecret(string key, string value)
  {
      if (_vaultProvider != null)
          _vaultProvider.Store(key, value);
      else
          File.WriteAllText($"{_dataPath}/variables.json", JsonConvert.SerializeObject(new { key, value }));
  }
  

• Patched (expected):

  public void SetSecret(string key, string value)
  {
      if (_vaultProvider != null)
          _vaultProvider.Store(key, value);
      else
      {
          var encrypted = DataProtection.Encrypt(value);  // DPAPI or similar
          File.WriteAllText($"{_dataPath}/variables.json", JsonConvert.SerializeObject(new { key, encrypted }));
      }
  }
  

Exploitation & Lab Setup

Red Team

Since no public exploit exists, simulate the attack as follows:

1. Install PowerShell Universal 2026.2.2 on a test VM.
2. Create a secret variable (e.g., API_Key) without configuring a vault.
3. As a low-privileged user (or after gaining code execution), navigate to %ProgramData%\Devolutions\PowerShellUniversal\variables.json.
4. Read the file – secret values appear in plaintext.

Example PowerShell command:

Get-Content "$env:ProgramData\Devolutions\PowerShellUniversal\variables.json"

Blue Team

To detect exploitation:

• Monitor for file access to variables.json by non‑privileged accounts.
• Use Sysmon Event ID 11 (FileCreate) and Event ID 4663 (Attempt to access an object).
• Audit read events on the configuration files.

Detection threshold: Repeated reads by a user who normally does not interact with PowerShell Universal.

Indicators of Compromise (IOCs)

• File Paths:
  • %ProgramData%\Devolutions\PowerShellUniversal\**\variables.json (Windows)
  • ~/.PowerShellUniversal/variables.json (Linux/macOS)
• Registry Keys (potential evidence of variable creation):
  • HKLM\SOFTWARE\Devolutions\PowerShellUniversal\Variables (if exported)
• Network Indicators: No remote network traffic unless vault is configured; cleartext storage does not generate C2 traffic.

Detection Engineering

YARA Rule

rule devolutions_pwu_cleartext_secrets {
    meta:
        description = "Detects cleartext secret variable storage in Devolutions PowerShell Universal"
        author = "Valters IT - DevSecOps"
        date = "2026-08-01"
        severity = "high"

    strings:
        $json_pattern = /"SecretValue"\s*:\s*"[^"]{8,}"/ nocase
        $variable_file = "variables.json"

    condition:
        $variable_file and #json_pattern > 0
}

Sigma Rule

title: Cleartext Secret Variable Read by Unprivileged User
id: 672a3c8e-1f4b-4a7b-9c2d-ef3b1a0c5e7a
status: experimental
description: Detects attempts to read the cleartext secret variable file by a non-admin user.
author: Valters IT
logsource:
    product: windows
    service: security
    category: file_access
detection:
    selection:
        EventID: 4663
        ObjectName|contains: '\Devolutions\PowerShellUniversal\variables.json'
        AccessMask: '0x1'  # ReadData
    filter:
        User|contains: 'NT AUTHORITY\SYSTEM'
    condition: selection and not filter
falsepositives:
    - Legitimate read by backup software (unlikely but possible)
level: high

Suricata Rule

alert file any any -> any any (msg:"CVE-2026-16802 - Devolutions PowerShell Universal cleartext secret file accessed"; file.content:"variables.json"; sid:1000001; rev:1; classtype:attempted-information-leak;)

Remediation & Mitigation

• Workaround: Configure an external vault (Devolutions Server, Azure Key Vault, etc.) immediately. Without a vault, secrets are stored in cleartext.
• Manual Mitigation (until patch):
  1. Encrypt the variables.json file using DPAPI or a script.
  2. Restrict file permissions: icacls variables.json /inheritance:r /grant "SYSTEM:F" "Administrators:F".
  3. Monitor access as per detection rules.
• Long-term Fix: The vendor must implement a built‑in encryption fallback (e.g., using the Windows Data Protection API) when no vault is selected.
• User Action: Review PowerShell Universal instances for any sensitive variables; rotate those secrets immediately.

Valters IT – DevSecOps & Cyber Threat Intelligence
Analysis compiled 2026-08-01 · Signature: V0.1