CVE-2026-13437

mediumCVSS 6.5covered by 1 sourcefirst seen 2026-06-29

Insertion of sensitive information into sent data in the AI Agent job API in Devolutions PowerShell Universal 2026.2.0 allows an authenticated user with AI Agent read access to obtain reusable, potentially higher-privileged authentication tokens via App Tokens serialized in plaintext in job API responses.

⚡ Watch CVE-2026-13437

Get an email if CVE-2026-13437 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all EPSS-scored CVEs.

Advisory coverage (1)

mediumCVE-2026-13437: Insertion of sensitive information into sent data in the AI Agent job API in Devolutions Power…nvd · 2026-06-29

External references

NVD record for CVE-2026-13437

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-13437 status](https://www.csirts.com/badge/CVE-2026-13437)](https://www.csirts.com/cve/CVE-2026-13437)