CVE-2026-129137

not scored yet · published 2026-11-13

Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server.

Weakness: CWE-276

Source: NVD CVE-2026-129137

References

• https://devolutions.net/security/advisories/DEVO-2026-0042/

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.