Devolutions PowerShell Universal versions 2026.3.4 and earlier have incorrect default permissions on the agent configuration folder. This vulnerability allows a local unprivileged user to execute arbitrary code with SYSTEM privileges by crafting a malicious agent configuration file that directs the agent to an attacker-controlled server.