CVE-2026-8694: Devolutions PowerShell Universal OpenAPI Specification Disclosure

Technical summary

CVE-2026-8694 is an improper access control vulnerability (CWE-306) in Devolutions PowerShell Universal affecting version 2026.1.7 and earlier. The flaw permits unauthenticated remote attackers to retrieve the OpenAPI specification of user-defined REST endpoints without authentication. The CVSS 3.1 score of 5.3 reflects the integrity impact of information disclosure—while no data modification or system availability disruption occurs, the unauthorized exposure of API metadata reduces the security posture of dependent systems. The attack requires only network access and no user interaction.

Business impact

This vulnerability creates an information disclosure risk in your REST API infrastructure. Exposed OpenAPI specifications can serve as reconnaissance for subsequent attacks by revealing endpoint structure, expected parameters, data types, and sometimes authentication requirements. In organizations where PowerShell Universal is used to expose internal business logic via REST endpoints, this leakage could enable attackers to map your API surface and identify further weaknesses. The risk is elevated if your endpoints interface with sensitive business processes, customer data, or downstream systems.

Affected systems

Devolutions PowerShell Universal version 2026.1.7 and all earlier releases are affected. Organizations should immediately identify all instances of PowerShell Universal in their environments, particularly those exposing REST endpoints to network-accessible locations. Check both production and development deployments, as specification leakage from development APIs can still reveal internal architecture.

Exploitability

This vulnerability has a low attack complexity and requires no authentication or user interaction—an attacker simply makes an HTTP request to retrieve the OpenAPI specification. However, the attacker must have network access to the PowerShell Universal instance. The practical exploitability depends on whether your instances are internet-facing or internal-only; internet-facing deployments present immediate risk. No known public exploit exists yet, but the attack method is straightforward enough that threat actors can quickly develop one once the vulnerability becomes widely known.

Remediation

Upgrade Devolutions PowerShell Universal to a patched version released after 2026.1.7. Verify the specific version number in the vendor advisory before deploying. As an interim measure, restrict network access to PowerShell Universal administration interfaces and REST endpoints through firewall rules, network segmentation, or reverse proxy authentication. If possible, place the service behind an authentication gateway that enforces access controls before requests reach the application.

Patch guidance

Contact Devolutions for patch availability and deployment guidance. Verify your current version using PowerShell Universal's admin interface or API. Once a patched version is available, test it in a non-production environment before rolling out to production. Given the low CVSS score, this is a standard-priority update rather than an emergency patch, but should be scheduled promptly to close the reconnaissance vector.

Detection guidance

Monitor HTTP requests to your PowerShell Universal instances for requests targeting OpenAPI specification endpoints (commonly /swagger/v1/swagger.json, /api/swagger, or similar paths depending on configuration). Log and alert on any requests that return OpenAPI content without authentication. Review access logs for the period before you patch to identify whether the specification has already been accessed. Network IDS/IPS signatures may be available from your security vendor once they process this CVE.

Why prioritize this

Prioritize this vulnerability as medium importance. While the CVSS score is 5.3, the true business risk depends on your deployment architecture. Internet-facing PowerShell Universal instances that expose business-critical REST endpoints warrant faster patching. Internal-only deployments present lower immediate risk but should still be patched in a standard change window. The lack of KEV listing and public exploits means this is not an emergency, but the simplicity of exploitation argues for prompt remediation.

Risk score, explained

The CVSS 3.1 score of 5.3 (MEDIUM) reflects the integrity impact vector—the vulnerability does not allow modification of data (I:L) and does not affect system availability (A:N). However, the low attack complexity (AC:L), lack of privilege requirements (PR:N), and lack of user interaction (UI:N) mean the exposure channel is wide open. The score is not higher because information disclosure alone, without modification or availability impact, receives a ceiling in CVSS scoring. In real-world terms, the business risk may be higher than the number suggests if your REST APIs are sensitive or if the exposed metadata enables follow-on attacks.

Frequently asked questions