8.3
CVE-2026-4064
- EPSS 0.05%
- Veröffentlicht 17.03.2026 19:14:17
- Zuletzt bearbeitet 19.03.2026 13:03:28
- Quelle security@devolutions.net
- CVE-Watchlists
- Unerledigt
LoginMissing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service operations — via crafted gRPC requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ironmansoftware ≫ Powershell Universal Version < 2026.1.4
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.05% | 0.136 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | 8.3 | 2.8 | 5.5 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.