Loading story…
Devolutions disclosed five vulnerabilities in PowerShell Universal 2026.2.2 and earlier, including two high-severity code injection flaws and multiple secret-handling weaknesses, all fixed in version 2026.2.3. The most serious issue, CVE-2026-16801, allows an authenticated user with variable write permission to inject arbitrary PowerShell code because user-supplied values are not properly escaped when written to the variables configuration file. A related flaw, CVE-2026-16800, affects the schedule feature, while Devolutions also reported improper access control issues in automation tests and workflows and exposure of stored OAuth refresh tokens.
A separate weakness, CVE-2026-16802, stores secret-type variables in plaintext on disk when no external vault is configured, exposing API keys, database connection strings, service account credentials, and other sensitive tokens to anyone with local read access. CERT Uganda warned that the code injection bugs could run with the privileges of the PowerShell Universal service account—often highly privileged on Windows Server—creating a path to full host compromise, data theft, lateral movement, and persistence. Organizations were urged to upgrade to PowerShell Universal 2026.2.3, audit variable and schedule configurations, review service account privileges, configure an external vault such as HashiCorp Vault, Azure Key Vault, or Windows DPAPI, and rotate any credentials that may have been exposed.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Devolutions stated in the advisory that the disclosed PowerShell Universal vulnerabilities are fixed in version 2026.2.3 or later, and affected organizations were advised to upgrade.
On July 24, 2026, Devolutions disclosed advisory DEVO-2026-0025 covering five vulnerabilities affecting PowerShell Universal 2026.2.2 and earlier, including code injection, cleartext secret storage, OAuth refresh token exposure, and improper access control issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcecert.ug
Open sourcedevolutions.net
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has disclosed a critical 0-day vulnerability in Windows PowerShell, tracked as CVE-2025-54100, which allows attackers to execute arbitrary code on affected systems. The flaw arises from improper neutralization of special elements in PowerShell's command processing, enabling command injection if an attacker can trick a user into running a malicious script or command. Exploitation requires local access and user interaction, but successful attacks can result in privilege escalation and full system compromise, making this vulnerability a significant risk for organizations relying on PowerShell for administration and automation. No official patch is available yet, and Microsoft has urged organizations to apply immediate mitigations and monitor for updates. The vulnerability is rated as 'Important' with a CVSS score of 7.8, and its potential for chaining with other exploits increases its attractiveness to threat actors. Attack vectors include phishing, watering-hole attacks, and supply-chain compromises where PowerShell scripts are abused during software installation or updates. Security teams are advised to remain vigilant and implement recommended mitigations until a patch is released.
Jun 29, 2026
Microsoft published multiple security advisories for **Windows**, **Azure**, and **developer tooling**, including several high-impact issues spanning **remote code execution (RCE)**, **elevation of privilege (EoP)**, **spoofing**, **information disclosure**, **denial of service**, and **security feature bypass**. Notable items include **Azure SDK for Python RCE** `CVE-2026-21531` (CVSS 9.8; **deserialization of untrusted data**), **Windows Shell security feature bypass** `CVE-2026-21510` (CVSS 8.8; exploitability listed as **E:F**), **GitHub Copilot/Visual Studio/VS Code** issues enabling **RCE/EoP/feature bypass** (`CVE-2026-21256`, `CVE-2026-21523`, `CVE-2026-21257`, `CVE-2026-21518`), and **Azure Local RCE** `CVE-2026-21228` (CVSS 8.1; **improper certificate validation**). Additional Windows platform flaws include **Desktop Window Manager EoP** `CVE-2026-21519` (type confusion), **HTTP.sys EoP** `CVE-2026-21232` (untrusted pointer dereference), **WinSock Ancillary Function Driver EoP** `CVE-2026-21238` (improper access control), **Windows Storage EoP** `CVE-2026-21508`, **WSL EoP** `CVE-2026-21237`, **Microsoft Word security feature bypass** `CVE-2026-21514`, **Outlook spoofing** `CVE-2026-21511`, **Windows LDAP DoS** `CVE-2026-21243`, plus **ACI Confidential Containers information disclosure** `CVE-2026-23655` and **Azure IoT Explorer information disclosure** `CVE-2026-21528`. Separately, a detailed third-party writeup described a **Windows Error Reporting Service** local privilege escalation, `CVE-2026-20817`, patched in January 2026, where the **WER service** (`wersvc.dll`) running as `NT AUTHORITY\SYSTEM` allegedly fails to validate requester permissions over **ALPC**, enabling a standard user to trigger process creation with a SYSTEM-derived token (retaining powerful rights such as *SeDebugPrivilege*, *SeImpersonatePrivilege*, and *SeBackupPrivilege*). Another third-party report highlighted a long-standing **libpng** heap buffer issue, `CVE-2026-25646` (CVSS 8.3), in `png_set_quantize()` that can be triggered by a crafted PNG (palette present, histogram absent) leading to an infinite loop/out-of-bounds read with potential for DoS and, with heap grooming, possible code execution; an additional MSRC entry referenced **libjpeg-turbo** `CVE-2023-2804` (heap-based overflow) as an Important RCE-class issue. Collectively, the disclosures reinforce the need to prioritize patching for internet-reachable components and developer tooling, and to treat local EoP bugs as high-risk in post-compromise and lateral movement scenarios.
Jun 29, 2026
Dell disclosed multiple high-severity vulnerabilities affecting enterprise storage and backup platforms, including **PowerProtect Data Domain**, **Storage Manager**, and **Unity**. In PowerProtect Data Domain, **CVE-2026-26944** allows unauthenticated remote attackers to reach a privileged function and potentially execute commands as `root` if a legitimate user performs a specific action, while **CVE-2026-26943** and **CVE-2026-23778** enable root-level command execution for attackers with high privileges. Dell said the issues affect several DD OS release tracks, Data Domain Virtual Edition, APEX Protection Storage, Data Domain Management Center, and PowerProtect DP Series appliances, and released fixes through advisory **DSA-2026-060**, adding that it had no indication of active exploitation. Dell also issued critical updates for other storage lines. **Dell Storage Manager** vulnerabilities **CVE-2025-43994** and **CVE-2025-43995** expose management functions and APIs to unauthenticated remote access or authentication bypass, potentially affecting all storage arrays managed by a vulnerable instance; Dell’s advisory **DSA-2025-393** recommends upgrading to **2020 R1.22** or later. In **Dell Unity**, **CVE-2025-36604** permits unauthenticated remote OS command injection, while **CVE-2025-36606** and **CVE-2025-36607** allow authenticated attackers to escape restricted utilities and run commands as `root`; Dell remediated those flaws in **Unity OE 5.5.1** and later. The disclosures highlight elevated risk to backup integrity, storage administration, and ransomware recovery operations if exposed management interfaces remain unpatched.
Jun 29, 2026