Devolutions PowerShell Universal Cleartext Storage of Secret Variables Allows Local Credential Theft (CVE-2026-16802)

Scope: Devolutions PowerShell Universal Versions 2026.2.2 and Earlier (No Vault Configured)

Severity: Medium

Also addressed in DEVO-2026-0025 alongside CVE-2026-16801, CVE-2026-16802 (CVSS 6.5) affects PowerShell Universal deployments where no external vault is configured, causing secret-type variables to be stored in plaintext on disk rather than encrypted. Any local user or process with read access to the PowerShell Universal application directory can retrieve these secrets, which commonly include database connection strings, API keys, service account credentials, and integration tokens used across automation workflows. While this requires local file system access rather than network exploitation, it is highly relevant in shared server environments or post-compromise scenarios where an attacker with limited initial access can pivot using harvested automation credentials. Organizations must upgrade to version 2026.2.3 immediately, configure a supported external vault (HashiCorp Vault, Azure Key Vault, or Windows DPAPI), and rotate all credentials that may have been stored as secret variables without vault protection.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.