PT-2026-25935 · Unknown · Powershell Universal

Publicado 2026-03-17 · Atualizado 2026-03-17 · CVE-2026-4064

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions PowerShell Universal versions prior to 2026.1.4

Description The software contains missing authorization checks on multiple gRPC service endpoints. An authenticated user possessing any valid token can bypass role-based access controls. This allows the user to perform privileged operations, including reading sensitive data, creating or deleting resources, and disrupting service operations, through crafted gRPC requests. The issue affects the gRPC service endpoints. The vulnerability allows bypassing of role-based access controls using crafted gRPC requests.

Recommendations Versions prior to 2026.1.4 should be updated to version 2026.1.4 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-4064

Produtos afetados

Powershell Universal

Referências · 5

• https://twitter.com/TheHackerWire/status/2034024210063110158 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2033994232923656254 · Publicação no Twitter
• https://devolutions.net/security/advisories/DEVO-2026-0008 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034032657525305585 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-4064 · Nota de Segurança