EUVD-2026-56303
GHSA-79hg-q5v7-878p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible SSRF requiring no authentication (PR:N) but user-triggered (UI:R); scope change (S:C) reflects cross-boundary internal resource access with high confidentiality loss and no integrity or availability impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Server-Side Request Forgery in Microsoft PowerShell Core versions 7.4.x, 7.5.x, and 7.6.x enables network-accessible unauthenticated attackers to forge outbound requests from the PowerShell process, resulting in high-impact information disclosure against resources outside the component's security boundary. The CVSS scope change (S:C) indicates that attacker-controlled SSRF requests can reach internal services inaccessible from the network perimeter, potentially exposing sensitive internal endpoints or metadata. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; Microsoft has released patched versions across all three affected branches.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) arises when an application makes outbound HTTP or network requests using attacker-influenced input without sufficient validation of the target URL. In PowerShell Core - Microsoft's cross-platform, open-source command shell and scripting environment - the vulnerable component fails to restrict or sanitize request targets, allowing the PowerShell process itself to act as a proxy for internal network requests. Affected product branches are PowerShell 7.4 (7.4.0 through pre-7.4.19.0), PowerShell 7.5 (7.5.0 through pre-7.5.10.0), and PowerShell 7.6 (7.6.0 through pre-7.6.5). The CVSS vector AV:N/AC:L confirms network reachability with low attack complexity, and the scope change (S:C) reflects the attacker's ability to pivot the SSRF to reach resources beyond the PowerShell execution boundary - such as internal APIs, cloud metadata services, or corporate intranet endpoints.
RemediationAI
Upgrade Microsoft PowerShell Core to the vendor-released fixed versions: 7.4.19.0 for the 7.4.x branch, 7.5.10.0 for the 7.5.x branch, or 7.6.5 for the 7.6.x branch, as confirmed by vendor patch availability and EUVD data. Full advisory details are available at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58612. If immediate patching is not feasible, restrict outbound network access from hosts running PowerShell Core using host-based firewall rules to an explicit allowlist of trusted destinations, which limits the SSRF reach to only permitted endpoints - note this may disrupt legitimate PowerShell network operations such as module downloads or REST API calls. Additionally, avoid executing untrusted or externally sourced PowerShell scripts on unpatched hosts, as user interaction is the required trigger for exploitation.
More in Powershell
View allRemote code execution in Microsoft PowerShell Core is achievable by unauthenticated network attackers exploiting a relat
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Cor
A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code
Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature t
PowerShell Remote Code Execution Vulnerability. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitab
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276),
Windows Graphics Component Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
PowerShell Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack comple
CVE-2025-30399 is an untrusted search path vulnerability in .NET and Visual Studio that allows unauthenticated remote at
.NET Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no aut
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
<p>A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an at
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today