CVE-2026-116627

Vulnerability Description

Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.

Related Weaknesses (CWE)

CWE-79

References

https://devolutions.net/security/advisories/DEVO-2026-0038/

FAQ

What is CVE-2026-116627?

CVE-2026-116627 is a documented vulnerability. Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user ...

How severe is CVE-2026-116627?

CVSS scoring is not yet available for CVE-2026-116627. Check NVD for updates.

Is there a patch for CVE-2026-116627?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.