Home / Vulnerability Intelligence / CVE-2026-4064

CVE-2026-4064 - Vulnerability Analysis

HighCVSS: 8.3

Last Updated: March 17, 2026

PowerShell Universal - Broken Access Control

Published: March 17, 2026Updated: March 17, 2026Remote Exploitable

Overview

PowerShell Universal < 2026.1.4 contains a broken access control vulnerability caused by missing authorization checks on multiple gRPC service endpoints, letting authenticated users bypass role-based access controls to perform privileged operations via crafted gRPC requests.

Severity & Score

Severity: High

CVSS Score: 8.3

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Authenticated users can bypass role-based access controls to read sensitive data, modify resources, and disrupt services.

Mitigation

Upgrade to version 2026.1.4 or later.

References

https://devolutions.net/security/advisories/DEVO-2026-0008

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 17, 2026

🟠 CVE-2026-4064 - High (8.3) Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-4064/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 17, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-4064
Severity: High
CVSS Score: 8.3
Type: broken_access_control
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-862

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

EPSS Score

0.0%Probability of exploitation in the next 30 days