What is CVE-2026-16798?

CVE-2026-16798 is a medium-severity vulnerability in Devolutions Powershell Universal, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 6.5/10. Published 2026-07-24.

How severe is CVE-2026-16798?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in Devolutions Powershell Universal

CVE-2026-16798

Insertion of sensitive information into sent data in the automation jobs API in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with scoped job or script read permission to obtain another user's stored OAuth refresh token via job read responses that fail to strip the refresh token.

EPSS: 0.002 (12.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Devolutions Powershell Universal — versions 0
Devolutions Powershell_universal

Weakness classification (CWE)

CWE-201 — Insertion of Sensitive Information into Sent Data

References

security@devolutions.net (Vendor Advisory)

Frequently asked questions

What is CVE-2026-16798?: CVE-2026-16798 is a medium-severity vulnerability in Devolutions Powershell Universal, classified under Insertion of Sensitive Information into Sent Data. CVSS score: 6.5/10. Published 2026-07-24.
How severe is CVE-2026-16798?: Medium severity. CVSS v3 base score is 6.5 out of 10.