Evil-WinRM CVE-2026-55201

Exploitation requires that (1) the victim is running Evil-WinRM 3.9 or earlier, (2) the victim invokes the download_dir() function specifically - single-file download is not affected - and (3) the remote Windows endpoint the victim has authenticated to is attacker-controlled or compromised such that the attacker can influence Get-ChildItem output. Limiting factors are significant: active user interaction (UI:A) is required, the attack is not automatable from the network alone, and the attacker must already possess a WinRM-reachable Windows host the operator chooses to connect to, which is why CVSS 4.0 marks AT:P. There is no special configuration on the client side beyond using the tool's documented directory-download feature against an untrusted server.

The CVSS 4.0 base of 7.4 (AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H) accurately reflects a high-impact but conditionally triggered flaw: the attacker needs to control the WinRM server the victim connects to (AT:P) and the victim must actively run download_dir() (UI:A). There is no KEV listing and no public exploit identified at time of analysis, and EPSS data was not provided, so signals point to a credible but not mass-exploited issue. Real-world risk is concentrated in offensive-security workflows where operators routinely connect Evil-WinRM to attacker-suspect or recently compromised hosts - exactly the population most likely to encounter a malicious server - so for that audience the practical risk is materially higher than the score suggests, while general enterprise exposure is low because the tool is not a server-side component.

A red team operator connects Evil-WinRM to a Windows host that has been previously compromised by another actor (or is a honeypot). The operator runs 'download_dir C:\loot ./loot' to bulk-pull files; the malicious host responds to Get-ChildItem with crafted entries like '..\..\..\..\home\operator\.ssh\authorized_keys' whose contents are an attacker-controlled SSH public key, giving the attacker persistent SSH access to the operator's workstation. No public PoC is identified at this time, but the upstream patch diff explicitly shows the vulnerable sink, making weaponization straightforward.