CVE-2026-3563
Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:L
- EPSS probability
- 0.34%
- CWE
- CWE-1289
- Published
- 2026-03-17
- Last modified
- 2026-03-18
Affected products
- Devolutions PowerShell Universal
Weakness type
Related vulnerabilities
- CVE-2026-76977 — Clickjacking vulnerability in SAPUI5(Frame Options Allowlist)
- CVE-2026-74994 — inets, httpd: Authentication Bypass via Directory Namespace Collapse in httpd mod_auth
- CVE-2026-19953 — URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep
- CVE-2026-60074 — Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check
- CVE-2026-47729 — Squid: Memory disclosure in FTP gateway
- CVE-2026-46644 — symfony/polyfill-intl-idn accepts xn-- labels whose Punycode payload decodes to ASCII-only: insecure equivalence
- CVE-2026-50090 — Aqara OAuth redirect_uri validation bypass
- CVE-2026-42462 — Fedify has an LD-Signature Bypass via JSON-LD Named-Graph Restructuring