What is the CVSS score of CVE-2026-50523?

CVE-2026-50523 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Microsoft PowerShell are affected by CVE-2026-50523?

Microsoft PowerShell vulnerability CVE-2026-50523 enables ordinary system users to execute unauthorized commands with their own privileges, creating risk of data theft, unauthorized system…. A patch is available.

How to fix or mitigate CVE-2026-50523?

Within 24 hours, inventory all systems running Microsoft PowerShell 7.4, 7.5, or 7.6 and assess exposure scope, particularly systems handling sensitive data or connected to critical infrastructure. Within 7 days, obtain the patched PowerShell version from Microsoft advisory and establish a deployment plan, beginning rollout to test and non-production environments. Within 30 days, complete patch deployment to all production systems and validate updates through configuration management tools; implement endpoint detection signatures to identify any exploitation attempts.

Microsoft PowerShell CVE-2026-50523

EUVD-2026-58808 HIGH

Command Injection (CWE-77)

2026-08-14 microsoft

GHSA-2x33-4fc7-ppvw

Command Injection Microsoft Powershell 7 4 Powershell 7 5 Powershell 7 6

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local vector and low-privilege requirement are consistent with authenticated shell access needed for command injection; full CIA impact reflects arbitrary code execution within the process scope.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 21:36 vuln.today

CVE Published

Aug 14, 2026 - 21:05 nvd

HIGH 7.8

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.

AnalysisAI

Command injection in Microsoft PowerShell 7.4, 7.5, and 7.6 allows a locally authenticated attacker with standard user privileges to execute arbitrary code on the affected system. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms exploitation requires only local access and a low-privileged account - no elevated rights, user interaction, or complex conditions are needed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity lowers the bar for exploitation once an injection point is discovered.

Technical ContextAI

Microsoft PowerShell is a cross-platform task automation and configuration management framework built on .NET, widely used in enterprise Windows and Linux environments for scripting, DevOps pipelines, and system administration. CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies the root cause as insufficient sanitization of user-controlled input before it is passed to a command interpreter - allowing injected shell metacharacters or control sequences to alter the intended command execution flow. Affected products per CPE data are cpe:2.3:a:microsoft:powershell_7.4:*:*:*:*:*:*:*:*, cpe:2.3:a:microsoft:powershell_7.5:*:*:*:*:*:*:*:*, and cpe:2.3:a:microsoft:powershell_7.6:*:*:*:*:*:*:*:*, covering all subversions across the 7.4, 7.5, and 7.6 branches. The specific vulnerable cmdlet, function, or code path is not identified in the available data.

RemediationAI

Apply the vendor-released patch for affected PowerShell 7.4, 7.5, and 7.6 installations as documented in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50523. Exact fixed build numbers within each 7.x branch are not specified in the available data and must be confirmed via the MSRC advisory before deployment. As compensating controls where immediate patching is not feasible, enforce PowerShell Constrained Language Mode (CLM) to restrict the language features available to non-administrative users, reducing the attack surface for injection-based techniques - note that CLM may break existing automation scripts relying on full-language mode. Additionally, restrict who can execute PowerShell 7.x via AppLocker or Windows Defender Application Control (WDAC) policies, limiting execution to known-good signed scripts. Audit and limit access to PowerShell remoting endpoints (WinRM, SSH) to reduce the population of users who can reach a vulnerable session. These controls reduce risk but do not eliminate it; patching remains the definitive fix.