{"affected":[{"defaultStatus":"unaffected","product":"PowerShell Universal","source":"CNA: DEVOLUTIONS","vendor":"Devolutions","versions":[{"lessThan":"2026.3.5","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-129137","cwes":["CWE-276"],"description":"Incorrect default permissions in the agent configuration folder in Devolutions PowerShell Universal 2026.3.4 and earlier allows a local unprivileged user to execute arbitrary code as SYSTEM via a crafted agent configuration file that points the agent to an attacker-controlled server.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1794608244043,"publishedAt":1794604967164,"references":[{"source":"CNA: DEVOLUTIONS","tags":[],"url":"https://devolutions.net/security/advisories/DEVO-2026-0042/"},{"source":"security@devolutions.net","tags":[],"url":"https://devolutions.net/security/advisories/DEVO-2026-0042/"}],"remediation":[],"revision":"29bfe4290f78a207626782b669e439f9a505308b17dbbf034b5775288412d59e","sources":[{"modifiedAt":1794604967164,"name":"CNA: DEVOLUTIONS","retrievedAt":1794607781544,"url":"https://www.cve.org/CVERecord?id=CVE-2026-129137"},{"modifiedAt":1794608244043,"name":"NVD","retrievedAt":1794615616897,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129137"}],"ssvc":null,"status":"published","title":"CVE-2026-129137","updatedAt":1794615616897}