CVE-2026-92237

Executive Summary

CVE-2026-92237 is an insertion of sensitive information into a log file (CWE-532) in the slow query logging feature of Devolutions PowerShell Universal 2026.2.5 and earlier. On instances backed by Microsoft SQL Server, SQL parameter values—including application tokens, data protection key material, and other stored credentials—are written to the system log, where any authenticated user holding log read permission can retrieve them. The flaw carries a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), reflecting a high confidentiality impact gated only by a low-privilege, authenticated foothold; no public exploit or KEV listing is currently known.

Technical Analysis

The vulnerability class is CWE-532: Insertion of Sensitive Information into Log File. It arises in the slow query logging subsystem of PowerShell Universal, specifically when the platform's backing datastore is Microsoft SQL Server. Slow query logging is a performance-diagnostic capability that records statements exceeding a configured duration threshold so administrators can identify costly queries. In this product and configuration, the logged representation includes the actual SQL parameter values rather than placeholders or redacted tokens.

Because PowerShell Universal is an application automation and scripting platform, its database interactions carry high-value secrets. According to the NVD description, the parameter values captured in the log can include application tokens, data protection key material, and other stored credentials. Data protection key material is especially consequential: it is the cryptographic root that protects other secrets at rest, so disclosure of those keys effectively extends the blast radius beyond the values literally present in the log line.

The trust boundary that fails is between the diagnostic logging layer and the confidentiality expectations of stored secrets. Sensitive values are serialized into a log sink that is readable by a broader audience than the set of users who can legitimately read the underlying secrets. The attack surface is the slow query logging feature on Microsoft SQL Server–backed deployments; no network exploit primitive, injection technique, or unauthenticated path is described. Exploitation requires an authenticated account, but only with log read permission—a role that is generally considered low-privilege. The CVSS vector is consistent with this: AV:N (log accessible remotely over the network through normal application access), AC:L, PR:L, UI:N, S:U, C:H, I:N, A:N.

No further implementation detail—such as the specific log file path, the exact parameter names, or the redaction code—is provided in the available NVD description, and none is invented here. The essential mechanism is that parameter values are not sanitized or masked before being written to the slow query log.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-92237; the attack chain below is inferred from the vulnerability class and the NVD description, and deliberately avoids naming any function, endpoint, file path, or parameter not present in that description.

1. Reconnaissance and target identification. An adversary first confirms the target is a Devolutions PowerShell Universal deployment and, critically, that it is "backed by Microsoft SQL Server"—the configuration the advisory scopes the flaw to. This can be established through banner or product fingerprinting, by inventory knowledge in an internal assessment, or by any authenticated user's observation of the platform's configuration. The attacker then needs, or needs to obtain, an authenticated account that holds log read permission.

2. Trigger and collection of the flaw. The attacker does not need to inject anything. Slow query logging operates passively: as normal application activity causes sufficiently slow SQL statements against the SQL Server backend, the slow query logging feature records those statements and their parameter values to the system log. The sensitive material—application tokens, data protection key material, and other stored credentials—is written into that log by the product itself. The attacker simply waits for organic traffic, or performs actions within their authorized scope that produce slow queries, then reads the resulting log entries.

3. Payload/execution method. The "exploitation" step is read access to log content, not code execution. The authenticated low-privilege user opens or exports the system log and extracts the recorded SQL parameter values. No crafted payload, injection string, or memory corruption primitive is required, which is why the attack complexity is low and no user interaction is needed.

4. Post-exploitation impact. The extracted values yield credentials that were intended to remain secret. Application tokens can be replayed against the platform to act with the privileges those tokens carry. Data protection key material can be used to decrypt other protected secrets, converting a single log-read permission into broad credential compromise. In multi-tenant or shared PowerShell Universal environments, the compromised identities and secrets may extend to integrated external systems. This matches the CVSS confidentiality impact of High, with Integrity and Availability rated None.

Impact Assessment

Business impact centers on credential and secret disclosure rather than service disruption or data tampering. An authenticated user with only log read permission—normally a modest role—can escalate to possessing application tokens, data protection key material, and other stored credentials. Because data protection keys underpin the confidentiality of other protected data, compromise can cascade: rotation of an exposed token is straightforward, but exposure of key material can force broad re-keying and re-encryption of dependent secrets.

Blast radius: PowerShell Universal is commonly used to automate administrative tasks and integrate with other systems, so credentials surfaced through it frequently grant access beyond the platform itself. The affected population is constrained to instances "backed by Microsoft SQL Server," which limits scope but does not reduce severity for those environments. CVSS subscores: Confidentiality High, Integrity None, Availability None, Scope Unchanged; Attack Vector Network (the log is reachable over the network via normal access), Attack Complexity Low, Privileges Required Low, User Interaction None. EPSS is 0.00149 (roughly the 4.5th percentile), indicating low predicted near-term exploitation activity; CISA KEV does not list it, and no threat-actor campaign or in-the-wild exploitation evidence is currently associated.

Detection Guidance

Detection should focus on log-read access patterns and on the presence of secret-like values in slow query log output, since the flaw itself is passive.

Sigma Rule

title: PowerShell Universal Slow Query Log Accessed by Low-Privilege User
id: 5b1f9c2e-7a44-4d0e-9c31-2026cve92237
status: experimental
description: Detects access to PowerShell Universal system logs that may contain slow query SQL parameter values with embedded secrets (CVE-2026-92237, CWE-532).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92237
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1552
  - cwe.532
logsource:
  product: windows
  service: security
detection:
  selection_access:
    EventID: 4663
    ObjectName|contains:
      - 'PowerShellUniversal'
      - 'Universal'
    ObjectName|endswith:
      - '.log'
  selection_read:
    AccessMask|contains:
      - '0x1'
      - 'ReadData'
  condition: selection_access and selection_read
falsepositives:
  - Legitimate administrative log review
level: medium

YARA Rule

rule CVE_2026_92237_PowerShellUniversal_LogSecretExposure
{
    meta:
        author = "valtersit.com"
        description = "Detects slow query log entries containing SQL parameter values with token or key material in PowerShell Universal (CVE-2026-92237)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92237"
        cve = "CVE-2026-92237"
        date = "2026-01-01"
    strings:
        $product = "PowerShell Universal" ascii wide nocase
        $slow = "slow" ascii wide nocase
        $sqltoken = "token" ascii wide nocase
        $dataprot = "DataProtection" ascii wide nocase
        $param = "parameter" ascii wide nocase
    condition:
        ($product and $slow) or
        ($slow and $sqltoken) or
        ($slow and $dataprot) or
        ($param and $sqltoken)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-92237 PowerShell Universal Log Read Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"PowerShellUniversal"; nocase; http.uri; content:"log"; nocase; sid:92237001; rev:1; reference:cve,2026-92237; metadata:author valtersit.com;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" ]
  [ file where file.name : "*.log" and file.path : "*PowerShellUniversal*" and event.action : "read" ]

Splunk SPL Query

index=* (sourcetype=*PowerShellUniversal* OR source="*.log")
| search "slow" ("token" OR "DataProtection" OR "parameter")
| stats count min(_time) as first_seen max(_time) as last_seen by host, source, user
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="devolutions,powershell_universal,cve_2026_92237,">
  <rule id="922370" level="10">
    <decoded_as>json</decoded_as>
    <field name="log">\.log</field>
    <field name="path">PowerShellUniversal</field>
    <match>slow|token|DataProtection</match>
    <description>CVE-2026-92237: possible read of PowerShell Universal slow query log containing sensitive SQL parameter values</description>
    <mitre><id>T1552</id></mitre>
    <group>credential_access,cwe_532,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source; vendor fix N/A, no workarounds provided by the vendor data).

1. Immediate mitigations. Restrict log read permission so it is granted only to accounts that are already trusted with access to the underlying secrets, and audit who currently holds it. Reduce the exposure window by lowering slow query log retention and reviewing/rotating any tokens, data protection keys, or stored credentials that may already have been written to logs on SQL Server–backed instances. Because the flaw is configuration-dependent ("instances backed by Microsoft SQL Server"), evaluate whether a non-Microsoft-SQL-Server backend avoids the affected path, and if so consider it as a temporary compensating measure. Enforce least privilege on slow query logging configuration itself.

2. Patch/upgrade steps. No fixed version exists per available data; affected range is 2026.2.5 and earlier. Monitor Devolutions' official advisory and release channels for a patched PowerShell Universal version, then upgrade promptly. Until a patch is issued, treat any exposed secret as compromised and perform credential/key rotation.

3. Long-term hardening. Adopt log sanitization policies that prevent SQL parameter values and secret material from being written to logs; require redaction at the logging layer for any query-diagnostic feature. Isolate high-value key material from diagnostic subsystems and apply the principle that log readers must never gain access to secrets they could not otherwise retrieve. Segment and restrict access to SQL Server–backed data stores, integrate secret-scanning into log pipelines to detect leaked tokens/keys, and include logging-subsystem reviews in routine security assessments against CWE-532.

References

• NVD — CVE-2026-92237: https://nvd.nist.gov/vuln/detail/CVE-2026-92237
• CWE-532: Insertion of Sensitive Information into Log File: https://cwe.mitre.org/data/definitions/532.html
• MITRE ATT&CK T1552 — Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
• Devolutions PowerShell Universal (vendor product/advisory channel): https://devolutions.net/powershell-universal/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-92237 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, Nuclei template, or exploit code is available, and no threat actor campaign or exploit-in-the-wild evidence is associated with CVE-2026-92237 at the time of writing. EPSS is 0.00149 (~4.5th percentile), indicating low predicted exploitation activity.