PT-2026-25935 · Unknown · Powershell Universal

Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-4064

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions PowerShell Universal versions prior to 2026.1.4

Description The software contains missing authorization checks on multiple gRPC service endpoints. An authenticated user possessing any valid token can bypass role-based access controls. This allows the user to perform privileged operations, including reading sensitive data, creating or deleting resources, and disrupting service operations, through crafted gRPC requests. The issue affects the gRPC service endpoints. The vulnerability allows bypassing of role-based access controls using crafted gRPC requests.

Recommendations Versions prior to 2026.1.4 should be updated to version 2026.1.4 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-4064

Affected Products

Powershell Universal

References · 5

• https://devolutions.net/security/advisories/DEVO-2026-0008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-4064 · Security Note
• https://twitter.com/TheHackerWire/status/2034024210063110158 · Twitter Post
• https://twitter.com/CVEnew/status/2033994232923656254 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034032657525305585 · Twitter Post