CVE-2026-129137
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
13/11/2026
Last modified:
13/11/2026
Description
Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server.