VulnerabilityPublished 17 Mar 2026

CVE-2026-3563: Devolutions PowerShell Universal · Improper validation of unsafe equivalence in input

Affects Devolutions PowerShell UniversalSource CVE Database V5

Compare

Not known to be exploited · CVSS 5.5 Medium : upgrade to 2026.1.4 when convenient.

Data as of 30 Oct 2026, 11:52 UTC

CVSS 3.1 base score

5.5Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.3% chance of exploitation in 30 days – higher than 29% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 2026.1.4

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: High
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: High: The attacker is authorized with (i.e., requires) privileges that provide significant (e.g., administrative) control over the vulnerable component that could affect component-wide settings and files.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 17 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Devolutions PowerShell Universal to 2026.1.4.

Affected software

Product	Affected	Fixed in
DevolutionsPowerShell Universal	Affected >=2026.1.0 <2026.1.4	Fixed in 2026.1.4

AI-suggested

To mitigate CVE-2026-3563, organizations should: 1) Immediately restrict permissions for creating or modifying Apps or Endpoints in PowerShell Universal to only trusted administrators. 2) Monitor and audit changes to app and endpoint configurations to detect unauthorized or suspicious modifications. 3) Apply the official patch or upgrade to PowerShell Universal version 2026.1.4 or later as soon as it becomes available. 4) Implement multi-factor authentication and strong access controls to reduce the risk of credential compromise for users with modification privileges. 5) Use network segmentation and firewall rules to limit access to the PowerShell Universal management interfaces. 6) Conduct regular security reviews of automation and orchestration tools to identify and remediate configuration weaknesses. 7) Consider implementing runtime monitoring to detect anomalous routing behavior or denial of service conditions caused by conflicting URL paths. These steps go beyond generic advice by focusing on permission management, proactive monitoring, and timely patching specific to this vulnerability.

Description

Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path.

Impact

The primary impact of CVE-2026-3563 is on the availability and integrity of applications managed by PowerShell Universal. By overriding existing routes, an attacker can redirect legitimate requests to unintended endpoints or cause conflicts that result in denial of service. This can disrupt automation workflows, administrative operations, and potentially critical business processes relying on PowerShell Universal. Organizations with complex automation environments may experience operational downtime or degraded service quality. Although the vulnerability requires authenticated access with specific permissions, insider threats or compromised accounts could exploit this flaw to cause significant disruption. The inability to properly validate route inputs also raises concerns about potential future exploitation vectors if combined with other vulnerabilities. Since PowerShell Universal is used globally in IT environments for automation, the impact could be widespread, affecting enterprise IT operations, cloud management, and DevOps pipelines.

CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)
Base weakness
The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

devolutions.net/security/advisories/DEVO-2026-0008 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 17 Mar 2026, 20:04 UTC

WeaknessesCWE-1289

Technical details

References

Community reviews

Related threats