PowerShell Core CVE-2026-70337

Exploitation requires the victim to perform some form of user interaction - likely opening, running, or importing a crafted file, script, or module within PowerShell Core, as indicated by the UI:R metric in the CVSS vector. The attacker requires no authentication (PR:N) and no special privileges on the target system. The vulnerability is reachable over the network (AV:N), meaning the crafted content can be delivered remotely without prior foothold. Exploitation is limited by: (1) mandatory user interaction - the victim must actively engage with attacker-supplied input; (2) the scope is unchanged (S:U), meaning the compromise is contained to the security context of the PowerShell process rather than escaping to a broader system boundary. The specific PowerShell Core configuration, cmdlet, or feature that processes the malicious path input is not identified in available data - consult the MSRC advisory for feature-specific exposure details.

The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8, indicating a high-severity, network-reachable, low-complexity flaw requiring no attacker privileges - but demanding one user interaction before exploitation succeeds. This UI:R gate is the primary natural mitigating factor reducing real-world risk below a 9.x critical rating. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified. No CISA KEV listing was present, and no public POC has been identified, meaning active exploitation is not confirmed. SSVC signals: exploitation status unconfirmed, technical impact is total (C/I/A:H), but automatable mass exploitation is constrained by the UI:R requirement. Organizations with large PowerShell Core remoting deployments or those running it as a service endpoint should treat this as a high-priority patch given the full C/I/A impact and low attacker complexity once interaction is obtained. The absence of patch version data in the references is a notable data gap - the MSRC advisory URL should be consulted directly to confirm fix versions.

An attacker delivers a crafted PowerShell script, module, or file reference containing a relative path traversal sequence to a targeted user - for example, through a phishing email or malicious download. When the victim executes or opens the content within PowerShell Core, the traversal bypasses directory boundary checks and causes PowerShell to load or execute an attacker-controlled file outside the intended path, resulting in arbitrary code execution with the victim's privileges. No public POC has been identified, but the low attack complexity (AC:L) suggests exploitation would be straightforward once the interaction is achieved.