This vulnerability (CVE-2026-16801) involves improper control of code generation (CWE-94) in Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with permission to write variables can inject arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file. This could lead to arbitrary code execution within the context of the application. The vulnerability is published but lacks a CVSS score and no official patch or remediation level has been disclosed. The product is not a cloud service, so remediation depends on vendor updates.

An authenticated user with variable write permission can execute arbitrary PowerShell code on the affected system. This could lead to unauthorized code execution, potentially compromising the application or underlying system depending on the privileges of the PowerShell Universal service. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict variable write permissions to trusted users only to reduce the risk of exploitation.