EUVD-2026-56608
GHSA-43rg-r573-6f25
Severity by source
AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Local vector and low-privilege requirement reflect mandatory existing account access; UI:R captures the privileged-user trigger dependency; full C/I/A reflects total post-escalation compromise with scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
AnalysisAI
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to already hold a valid low-privilege local account on the target system (PR:L, AV:L) - this is not remotely exploitable over a network without prior access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.3 with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H indicates low attack complexity once local access exists, but constrains exploitation to local-only vectors and requires user interaction - a privileged party must take action. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to the patched release for your installed branch: PowerShell 7.4.19.0, 7.5.10.0, or 7.6.5, available via the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59119 and through standard PowerShell GitHub release channels. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all systems running PowerShell 7.4.x, 7.5.x, or 7.6.x using patch management and asset discovery tools to establish remediation scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powershell
View allRemote code execution in Microsoft PowerShell Core is achievable by unauthenticated network attackers exploiting a relat
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Cor
A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code
Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature t
Server-Side Request Forgery in Microsoft PowerShell Core versions 7.4.x, 7.5.x, and 7.6.x enables network-accessible una
PowerShell Remote Code Execution Vulnerability. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitab
Windows Graphics Component Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
PowerShell Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack comple
CVE-2025-30399 is an untrusted search path vulnerability in .NET and Visual Studio that allows unauthenticated remote at
.NET Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no aut
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
<p>A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an at
Same weakness CWE-276 – Incorrect Default Permissions
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today