CVE-2026-0618
📋 TL;DR
A cross-site scripting (XSS) vulnerability in Devolutions PowerShell Universal allows attackers to inject malicious scripts into web pages viewed by other users. This affects all deployments running PowerShell Universal versions before 4.5.6 or before 5.6.13. Users accessing the vulnerable web interface are at risk.
💻 Affected Systems
- Devolutions PowerShell Universal
📦 What is this software?
Powershell Universal by Ironmansoftware
Powershell Universal by Ironmansoftware
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as authenticated users, redirect to malicious sites, or deploy malware through the PowerShell Universal interface.
Likely Case
Session hijacking, credential theft, or unauthorized actions performed through the compromised user's session.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though some functionality may still be affected.
🎯 Exploit Status
XSS vulnerabilities typically have low exploitation complexity once the injection point is identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.5.6 or 5.6.13
Vendor Advisory: https://devolutions.net/security/advisories/DEVO-2026-0001/
Restart Required: Yes
Instructions:
1. Backup your PowerShell Universal configuration and data. 2. Download the patched version (4.5.6 or 5.6.13) from the Devolutions website. 3. Install the update following the vendor's upgrade documentation. 4. Restart the PowerShell Universal service.
🔧 Temporary Workarounds
Input Validation Enhancement
allImplement additional input validation for user-supplied data in web forms
Content Security Policy
allImplement strict Content Security Policy headers to mitigate XSS impact
🧯 If You Can't Patch
- Restrict network access to PowerShell Universal interface to trusted users only
- Implement web application firewall (WAF) rules to block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check PowerShell Universal version in the web interface under Settings > About or via PowerShell command: Get-PSUVersionCheck Version:
Get-PSUVersionVerify Fix Applied:
Verify version is 4.5.6 or higher (for v4.x) or 5.6.13 or higher (for v5.x) after patching📡 Detection & Monitoring
Log Indicators:
- Unusual script tags or JavaScript in web request logs
- Multiple failed XSS attempts in web server logs
Network Indicators:
- Suspicious script payloads in HTTP requests to PowerShell Universal endpoints
SIEM Query:
source="powershell_universal" AND (http_request CONTAINS "<script>" OR http_request CONTAINS "javascript:")