CVE-2026-16798
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Devolutions | PowerShell Universal | < 2026.2.3 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-16798
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
通过发送数据的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Devolutions | PowerShell Universal | 0 ~ 2026.2.3 | - |
II. Public POCs for CVE-2026-16798
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-16798
请登录查看更多情报信息。
Same Patch Batch · Devolutions · 2026-07-24 · 5 CVEs total
| CVE-2026-16802 | PowerShell Universal 2026.2.2敏感信息明文存储漏洞 | |
| CVE-2026-16799 | Devolutions PowerShell Universal 2026.2.2及之前版本存在访问控制漏洞 | |
| CVE-2026-16801 | Devolutions PowerShell Universal代码注入漏洞 | |
| CVE-2026-16800 | Devolutions PowerShell Universal代码注入漏洞 |
IV. Related Vulnerabilities
Same product: PowerShell Universal
Same weakness: CWE-201
- CVE-2026-66339
Libsoup: libsoup: proxy credentials leak to destination serv - CVE-2026-27372
WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Sensit - CVE-2026-12547
Libsoup: information disclosure in libsoup via soupauthmanag - CVE-2026-13380
VSee Clinic and API Exposes Cleartext SFTP Credentials in Un - CVE-2026-54171
Excon: redact additional sensitive/risky headers when follow
V. Comments for CVE-2026-16798
No comments yet