CVE-2026-4064: Ironmansoftware PowerShell Universal

High severity, CVSS 8.3. EPSS: 0.4% chance of exploitation in the next 30 days.

Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service operations — via crafted gRPC requests.

Affected products

• Ironmansoftware PowerShell Universal: before 2026.1.4 (fixed in 2026.1.4)

Published 2026-03-17. Last modified 2026-06-17.