Windows PowerShell CVE-2025-54100

Exploitation requires local access to the target and user interaction: a logged-in user must open or execute attacker-supplied content within Windows PowerShell, at which point improperly neutralized special elements allow command injection in that user's context (PR:N but UI:R). It cannot be triggered remotely over the network (AV:L). The limiting factors are the mandatory user interaction and local vector - an attacker must first get a malicious script/file/command to a victim and convince them to run it. Affected default configurations span Windows 10 (1607-22H2), Windows 11 (23H2-25H2), and Windows Server 2008 through 2025, so no non-default feature toggle is needed beyond having PowerShell (present by default).

This is a genuinely actionable but not emergency-tier issue. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 7.8 HIGH) describes local code execution requiring user interaction: the attacker cannot reach this over the network and needs a victim to open or run something. Note the apparent tension between PR:N (no privileges required) and UI:R (user interaction required) - the attacker themselves needs no account, but success depends on a legitimate user triggering the malicious content, which materially lowers real-world exploitability versus a pure remote-unauth flaw. EPSS is 2.23% (82nd percentile) - elevated relative to the median CVE but far from the near-certain range, consistent with a plausible-but-not-trivially-mass-exploitable local vector. There is no CISA KEV listing and no public exploit code identified (the two Vicarius vSociety references are detection/mitigation write-ups, not weaponized POCs). Net: prioritize as part of normal Patch Tuesday cadence for Windows fleets, not as a drop-everything zero-day. The very broad affected-platform footprint (Windows 10/11 across builds, Server 2008 through 2025) raises aggregate exposure even though per-host exploitation requires user interaction.

An attacker crafts a malicious file, script, or command string that improperly neutralizes special elements, then lures a logged-in user (via phishing attachment, malicious repo, or social engineering) into opening or executing it in Windows PowerShell. When the user runs it, injected commands execute in the user's security context, achieving arbitrary code execution locally (C:H/I:H/A:H). No public exploit code has been identified, so an attacker would need to develop the trigger themselves.