CVE-2026-3563 - Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path

Back Back to CVE browser

MEDIUM

Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path

Published Mar 17, 2026

5.5

MEDIUM

CVSS 3.1

EPSS 0.40%

Description

Improper input validation in the apps and endpoints configuration in PowerShell Universal before 2026.1.4 allows an authenticated user with permissions to create or modify Apps or Endpoints to override existing application or system routes, resulting in unintended request routing and denial of service via a conflicting URL path.

Affected products

Vendor Devolutions Product PowerShell Universal Default
unaffected
- Version
  2026.1.0
  Status
  affected
  Constraints
  <2026.1.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Devolutions

PowerShell Universal

unaffected

Version	Status	Constraints
2026.1.0	affected	<2026.1.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1289

References (1)

https://devolutions.net/security/advisories/DEVO-2026-0008
Vendor Advisory

Link	Providers	Tags
https://devolutions.net/security/advisories/DEVO-2026-0008		Vendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner DEVOLUTIONS

Published Mar 17, 2026

Updated Mar 17, 2026

Reserved Mar 4, 2026

Link CVE-2026-3563

CISA Vulnrichment

Updated Mar 17, 2026

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2026-3563

Red Hat

Severity n/a

Public date n/a

Links CVE-2026-3563