CVE-2026-129137

EUVD-2026-125777
Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
DEVOLUTIONSCNA
UNKNOWN
---
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
devolutionspowershell_universal
𝑥
< 2026.3.5
CNA
Common Weakness Enumeration
References
https://devolutions.net/security/advisories/DEVO-2026-0042/