CVE-2026-19768

Executive Summary

CVE-2026-19768 is a code injection vulnerability in the settings feature of Devolutions PowerShell Universal 2026.2.3 and earlier. An authenticated user who holds settings management permission can supply a crafted setting value that is not properly escaped before being written to the settings configuration file. Exploitation results in arbitrary PowerShell code execution in the context of the PowerShell Universal application process, with a CVSS score of 8.1 due to high confidentiality and integrity impact.

No vendor patch, public exploit, or CISA KEV listing is available at the time of writing. The vulnerability is unpatched across all identified tracked sources, and exploitation is inferred from the vulnerability class rather than from a public proof of concept.

Technical Analysis

The NVD description places this vulnerability in the CWE-94 category: Improper Control of Generation of Code, commonly referred to as code injection. The flaw exists in the settings feature of Devolutions PowerShell Universal. An authenticated user with settings management permission can submit a setting value containing PowerShell syntax. The application does not escape the value before serializing it into the settings configuration file. When that configuration file is later loaded, parsed, or interpreted by the PowerShell Universal runtime, the embedded content is treated as executable code instead of inert data.

Because the NVD description does not disclose the exact configuration file name, application endpoint, or parameter name, the following analysis remains at the vulnerability-class level. The fundamental mechanism is an injection boundary failure: user-controlled input is written into a file that is subsequently consumed by a PowerShell-based loader. If the output encoding does not neutralize PowerShell metacharacters, expression syntax, or string terminators, the payload transitions from a configuration value into code.

The attack surface is the management plane of PowerShell Universal. The product is commonly used to create, host, and orchestrate PowerShell scripts and APIs, so the underlying runtime itself is PowerShell-aware. The settings configuration file is trusted by the application process. This means the injection point does not require the attacker to break out of a sandboxed script interpreter at execution time; the corruption occurs during configuration serialization. The resulting code executes with the privileges of the PowerShell Universal service account, which is often configured with broad access to automation, secrets, and connected infrastructure.

The lack of patch data and vendor advisory details means the exact serialization mechanism is not publicly known. However, the high CVSS sub-scores for confidentiality and integrity, combined with low attack complexity, indicate that the injection is straightforward to trigger: network access, low privileges, no user interaction, and no special conditions are required beyond the authenticated settings permission.

Exploitation Scenarios

The following attack chain is derived strictly from the information available in the NVD description and the vulnerability class. No public PoC exists, and specific endpoints or encoded payload patterns are not confirmed.

1. Reconnaissance and target identification
   An attacker locates an internet-exposed PowerShell Universal instance using query strings such as http.html:"PowerShell Universal" or http.title:"PowerShell Universal". The attacker then obtains or abuses valid credentials for an account that has settings management permission. This could be a low-privileged administrative role in the application, a shared account, or a compromised credential obtained through phishing or password spraying.

2. Triggering the injection
   The attacker navigates to the settings feature of the application. Instead of entering a legitimate value, the attacker submits a crafted setting value containing PowerShell code. The value is stored by the application without sufficient escaping or sanitization. Because the application trusts the settings data and writes it directly into a PowerShell-interpreted configuration file, the boundary between stored data and executable code is broken.

3. Payload execution
   Once written, the malformed setting is either re-read immediately or consumed on the next settings reload/restart. The PowerShell Universal runtime parses the configuration file, and the attacker-controlled content is evaluated as PowerShell. Payloads at this class typically use PowerShell expression syntax, sub-expression operators, or encoded commands to execute arbitrary logic. No public PoC is available, so the exact payload format is inferred from the CWE-94 code injection class rather than from a disclosed exploit.

4. Post-exploitation impact
   The injected PowerShell runs in the context of the PowerShell Universal service account. Depending on the service account’s privileges, the attacker can extract stored credentials and secrets, modify existing automation scripts, install persistence, create local accounts, move laterally to connected systems, or disrupt the PowerShell Universal environment. The CVSS impact sub-scores indicate high confidentiality and integrity impact; availability is not directly scored as affected.

Impact Assessment

CVE-2026-19768 carries a CVSS base score of 8.1 with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. Key observations:

• Attack Vector: Network — the management interface can be reached remotely.
• Attack Complexity: Low — no special conditions are described beyond crafted input.
• Privileges Required: Low — the attacker must hold settings management permission, not necessarily full administrative rights.
• User Interaction: None — no victim interaction is required.
• Scope: Unchanged — the compromise remains within the application process.
• Confidentiality and Integrity: High — arbitrary PowerShell code can read and modify application data, managed secrets, and possibly the host filesystem.
• Availability: Not affected — the CVSS vector does not assign availability impact.

For an enterprise, the business impact is significant because PowerShell Universal is often deployed as a central automation hub. A settings-level attacker who gains code execution can turn that access into a full server compromise, inflating the real-world risk beyond the numeric score. The absence of a patch increases exposure, and the lack of public exploit code does not guarantee that targeted exploitation is not occurring.

Detection Guidance

No public exploit exists, and no network signature can be derived from a confirmed payload. The detection rules below are behavioral and heuristic. They are intended to identify the attempts and likely side effects of this vulnerability class.

Sigma Rule

title: Suspicious PowerShell Code in PowerShell Universal Settings
id: 5f86c4a1-2e11-4c59-9f9a-3b7ec0b91e84
status: experimental
description: Detects PowerShell interpreter activity or command-line patterns consistent with code injection into Devolutions PowerShell Universal settings configuration files.
logsource:
  product: windows
  category: process_creation
detection:
  selection_parent:
    ParentImage|contains:
      - 'PowerShellUniversal'
      - 'PSU'
  selection_payload:
    CommandLine|contains:
      - 'Invoke-Expression'
      - 'IEX'
      - 'DownloadString'
      - '-EncodedCommand'
      - 'FromBase64String'
  condition: selection_parent and selection_payload
level: high
falsepositives:
  - Legitimate use of PowerShell Universal executing product-managed scripts
tags:
  - attack.execution
  - attack.t1059.001
  - cve.2026.19768

YARA Rule

rule CVE_2026_19768_PSU_Settings_CodeInjection
{
    meta:
        author = "Valters IT"
        description = "Detects PowerShell code injection artifacts in Devolutions PowerShell Universal settings configuration files"
        cve = "CVE-2026-19768"
        severity = "high"
    strings:
        $s1 = /Invoke-Expression|IEX\s*\(/ ascii nocase
        $s2 = /DownloadString\s*\(/ ascii nocase
        $s3 = /-EncodedCommand\s+/ ascii nocase
        $s4 = /\$\{?\s*[A-Za-z_]/ ascii
        $s5 = ".Net.WebClient" ascii nocase
    condition:
        filesize < 10MB and 2 of them
}

Suricata IDS Rule

Network detection is limited because the injection is triggered through an authenticated management interface. The rule below flags HTTP POST bodies carrying PowerShell execution indicators.

alert http any any -> any any (msg:"CVE-2026-19768 PowerShell Universal Code Injection Attempt - PowerShell payload in HTTP body"; flow:to_server,established; content:"POST"; http_method; pcre:"/Invoke-Expression|IEX\s*\(|DownloadString|-EncodedCommand|FromBase64String/i"; classtype:attempted-admin; sid:202619768; rev:1;)

Elastic Detection

The following EQL query looks for PowerShell processes spawned by a PowerShell Universal-related parent process, or for settings files containing suspicious PowerShell content.

process where event.action == "execution" and
  process.name : ("powershell.exe", "pwsh.exe") and
  process.parent.name : ("*Universal*", "PSU*") and
  process.command_line : ("*Invoke-Expression*", "*IEX*", "*DownloadString*", "*-EncodedCommand*", "*FromBase64String*")

Splunk SPL Query

index=windows sourcetype=WinEventLog:Security
| search EventCode=4688 OR EventCode=1
| search (ParentImage="*Universal*" OR ParentImage="*PSU*") AND (CommandLine="*Invoke-Expression*" OR CommandLine="*IEX*" OR CommandLine="*DownloadString*" OR CommandLine="*-EncodedCommand*" OR CommandLine="*FromBase64String*")
| table _time, host, User, ParentImage, Image, CommandLine
| sort -_time

Wazuh OSSEC Rule

<rule id="100268" level="12">
  <decoded>ar</decoded>
  <field name="win.eventdata.parentImage">\.*Universal.*</field>
  <field name="win.eventdata.commandLine">\.*(Invoke-Expression|IEX|DownloadString|-EncodedCommand|FromBase64String).*</field>
  <description>CVE-2026-19768: Possible PowerShell code injection into PowerShell Universal settings</description>
  <mitre>
    <id>T1059.001</id>
  </mitre>
  <group>powershell_universal_code_injection,</group>
</rule>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence exists from any tracked source. The vendor fix is listed as unavailable, and no workarounds have been published.

1. Immediate mitigations

   • Restrict settings management permission to the smallest possible group of trusted administrators.
   • Require phishing-resistant multi-factor authentication for all accounts that can access the management interface.
   • Segment PowerShell Universal so that the management interface is not exposed to the internet or to untrusted network zones.
   • Deploy host-based monitoring for file writes to PowerShell Universal settings configuration files and for unexpected PowerShell process execution.

2. Patch and upgrade steps

   • No patched version is currently identified. Monitor Devolutions’ official advisory and release channels for a version newer than 2026.2.3.
   • If a patched release becomes available, prioritize testing and deployment based on the high CVSS score.
   • Until then, treat all PowerShell Universal instances running 2026.2.3 or earlier as vulnerable.

3. Long-term hardening

   • Apply least privilege at the service account level for the PowerShell Universal runtime. Do not run the service as a domain administrator or with broad infrastructure access.
   • Implement configuration file integrity monitoring using file hashes, auditd/Sysmon, or EDR agents.
   • Enforce input validation and output escaping across all settings fields, especially any value that is later interpreted by PowerShell.
   • Maintain a current inventory of all PowerShell Universal instances and their versions so that a patch can be applied immediately once released.
   • Monitor the vendor and CISA KEV catalog for status changes.

References

• NVD Entry — https://nvd.nist.gov/vuln/detail/CVE-2026-19768
• MITRE CVE Record — https://www.cve.org/CVERecord?id=CVE-2026-19768
• CWE-94: Improper Control of Generation of Code — https://cwe.mitre.org/data/definitions/94.html
• Devolutions PowerShell Universal Product Page — https://devolutions.net/powershell-universal/
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns, exploit-in-the-wild evidence, or public proof-of-concept are known at the time of writing. The vulnerability is not listed in CISA KEV and no Nuclei template or exploit code has been identified.