Unscored severity · published Oct 27, 2026
CVE-2026-116627
Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows…
New
–
CVSS
–
EPSS
No
On KEV
Description
Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PU
PowerShell Universal · Devolutions
before 2026.3.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116627
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116627
devolutions.net
https://devolutions.net/security/advisories/DEVO-2026-0038/
More from PowerShell Universal
8.8
CVE-2026-16801
Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with…
8.8
CVE-2026-16800
Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with…
8.3
CVE-2026-4064
Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based…
8.1
CVE-2026-19768
Improper control of generation of code ('Code Injection') in the settings feature in Devolutions PowerShell Universal 2026.2.3 and earlier allows an authenticated user with…
6.5
CVE-2026-92237
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log…