EUVD-2026-56768
GHSA-c9mw-2c7x-gc2r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Network-delivered path traversal with no attacker privileges required; user interaction gates exploitation; full C/I/A impact from arbitrary code execution; scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft PowerShell Core is achievable by unauthenticated network attackers exploiting a relative path traversal flaw (CWE-23), provided the victim performs some user interaction. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with no privilege requirement on the attacker's side, making this a significant threat in enterprise environments where PowerShell Core is ubiquitous. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to perform some form of user interaction - likely opening, running, or importing a crafted file, script, or module within PowerShell Core, as indicated by the UI:R metric in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8, indicating a high-severity, network-reachable, low-complexity flaw requiring no attacker privileges - but demanding one user interaction before exploitation succeeds. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patch released by Microsoft for PowerShell Core as documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70337. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Microsoft PowerShell Core installations and identify dependencies on this tool for critical operational and administrative processes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powershell
View allA denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Cor
A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code
Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature t
Server-Side Request Forgery in Microsoft PowerShell Core versions 7.4.x, 7.5.x, and 7.6.x enables network-accessible una
PowerShell Remote Code Execution Vulnerability. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitab
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276),
Windows Graphics Component Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
PowerShell Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack comple
CVE-2025-30399 is an untrusted search path vulnerability in .NET and Visual Studio that allows unauthenticated remote at
.NET Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no aut
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
<p>A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an at
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today