CVE-2026-16802: Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read se
Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected.
Details
Original advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-16802
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2026-168020.08% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 0% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2026-16802 | coverage & exploitation status | NVD · CVE.org |
Recent advisories for Cleartext storage of
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownCVE-2026-34490: Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application …nvd · 2026-07-31
- highCVE-2026-40430: Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerab…nvd · 2026-07-23
- mediumCVE-2026-38571: Cleartext storage and exposure of WPA2 credentials, and missing authentication on the rr/wr me…nvd · 2026-06-26
- criticalexploitedCVE-2011-4723: D-Link DIR-300 Router Cleartext Storage of a Password Vulnerabilitycisa-kev · 2022-09-08
More from NVD Recent CVEs
- mediumCVE-2026-67355: guzzlehttp/guzzle versions before 7.15.1 fail to preserve host-only cookie scope, storing the …2026-08-01
- mediumCVE-2026-67354: guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in Re…2026-08-01
- mediumCVE-2026-67353: guzzlehttp/guzzle versions before 7.15.1 contain a denial of service vulnerability in the Cook…2026-08-01
- highCVE-2026-67352: luci-app-https-dns-proxy contains a stored cross-site scripting vulnerability in the resolver_…2026-08-01
- mediumCVE-2026-67344: ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYP…2026-08-01