PowerShell Core CVE-2026-58612

The CVSS vector PR:N confirms no authentication is required from the attacker's perspective, and the description characterizes the attacker as 'unauthorized.' However, UI:R (user interaction required) means exploitation is contingent on a target user performing an action - most likely executing attacker-supplied or attacker-influenced PowerShell script content within an affected PowerShell Core version. Exploitation is limited to PowerShell 7.4.0-7.4.18, 7.5.0-7.5.9.x, or 7.6.0-7.6.4; patched versions are not vulnerable. The SSRF impact is bounded by the network reachability of the host running PowerShell Core - environments where the host cannot reach internal services or metadata endpoints face reduced disclosure risk. The specific PowerShell feature or cmdlet that triggers the SSRF request is not identified in the available data.

The CVSS base score of 7.4 (High) is driven primarily by the combination of network accessibility with no authentication requirement (AV:N/PR:N), high confidentiality impact (C:H), and a scope change (S:C) indicating cross-boundary information leakage. The UI:R (user interaction required) component introduces meaningful friction - exploitation is not fully passive and depends on a user action such as executing attacker-influenced script content. No EPSS score was supplied in the intelligence data, preventing quantitative exploitation-probability comparison; KEV status is not confirmed, so widespread active exploitation cannot be asserted. Even a mid-sized municipal IT team in sopot should treat this as urgent if they operate PowerShell Core in environments where internal services or cloud metadata endpoints are reachable from the host, since SSRF scope changes in scripting engines can expose credentials or service tokens. The absence of known public exploit code modestly reduces short-term risk, but the low attack complexity and zero-authentication requirement make this a realistic target for motivated actors once exploitation techniques are published.

An attacker delivers a malicious PowerShell script or crafts input consumed by an affected PowerShell Core process - for example, embedding a SSRF-triggering URI in a script distributed via phishing or a compromised repository. When a user executes the content, PowerShell Core issues a server-side HTTP request to an attacker-specified internal endpoint (such as a cloud instance metadata service at 169.254.169.254 or an internal API), and the response data is exfiltrated to the attacker. No public proof-of-concept exploit code has been identified at time of analysis, but the low attack complexity and absence of required authentication make the technique straightforward once the triggering mechanism is understood.