CVE-2026-4064 — Devolutions / PowerShell Universal

CVE-2026-4064

Devolutions / PowerShell Universal PUBLISHED

Description (CNA)

Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service operations — via crafted gRPC requests.

Affected (CNA)

Vendor / product	Versions
Devolutions / PowerShell Universal	affected 2026.1.0 before 2026.1.4

CWE

CWE-862

References

https://devolutions.net/security/advisories/DEVO-2026-0008

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.