Get real-time updates on Telegram
CVE-2026-16798: powershell universal before 2026.2.3.0 (exclusive); +1 more affected products
CVE-2026-16798. CVSS 3.1 base score 6.5 (MEDIUM, Source advisory). EPSS 0.00379 (percentile 0.30721), scored 22-Oct-2026.
Affected technology
powershell universal · before 2026.2.3.0 (exclusive)
devolutions
PowerShell Universal · 0 to before 2026.2.3
Devolutions
Description’s affected range: 2026.2.2 and earlier
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
An authenticated user with scoped job or script read permission can obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token. Source advisory’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality impact as high; integrity and availability impact as none.
- CWE
- CWE-201
- CCR priority
- 26.1 /100 (P4)
- CVSS 3.1
- 6.5 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · Source advisory
- EPSS
- 0.00379 · percentile 0.30771 · 2026-10-24
- KEV
- no
Provenance
- FIRST EPSS daily exploit-probability · Source record · observed 2026-10-24 15:09:16.138216+00:00 UTC
- NVD CVE API 2.0 · Source record · observed 2026-10-24 15:07:27.951960+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-16798.html