Windows PowerShell CVE-2026-69807

The attacker must hold a valid low-privileged account (local or domain) on the target system, satisfying the PR:L CVSS metric - unauthenticated exploitation is not possible. PowerShell Remoting (WinRM, TCP 5985/5986) must be enabled and reachable from the attacker's position for the AV:N vector to apply; environments with WinRM disabled or restricted to management VLANs face significantly reduced exposure. UI:R indicates that some form of user interaction is required, which may mean a privileged user must execute or invoke the malicious path, limiting fully autonomous exploitation. The flaw affects all default-supported PowerShell configurations on the listed Windows versions; no non-default feature flag or special configuration is documented as required beyond WinRM accessibility.

The CVSS 8.0 base score reflects a network-reachable, low-privilege, user-interaction-required privilege escalation with full C/I/A impact - a credible high-severity finding. The AV:N vector is consistent with PowerShell Remoting (WinRM on TCP 5985/5986) being exposed, which is common in enterprise environments. PR:L confirms that a valid but unprivileged domain or local account is sufficient, lowering the attacker barrier significantly. UI:R introduces a dependency on victim interaction, which partially mitigates automated mass exploitation. No KEV listing or public POC has been identified, and EPSS data was not provided, so real-world exploitation probability cannot be quantitatively assessed. The extremely broad affected version range - spanning EOL products (Server 2012/R2) through current (Windows 11 26H1) - materially increases the attack surface. Organizations with EOL Server 2012/R2 systems face heightened risk as those require ESU coverage. The privilege escalation outcome (C:H/I:H/A:H) suggests full system compromise post-exploitation.

An attacker with a valid low-privileged domain account connects to a target Windows server via PowerShell Remoting (WinRM), then delivers a specially crafted script or path argument that exploits the path traversal flaw to write or access files outside the restricted directory boundary. By placing a malicious payload in a privileged location (e.g., a startup or service directory), the attacker achieves privilege escalation to SYSTEM or administrator level on the target host. No public POC has been identified at time of analysis, but the low-privilege/network-accessible attack surface makes this a plausible internal lateral movement or privilege escalation vector.