Microsoft PowerShell CVE-2026-70338

Exploitation requires local access to the target system - remote unauthenticated network exploitation is not indicated by the AV:L vector. User interaction is required (UI:R), meaning a victim must take an action such as opening, running, or interacting with attacker-supplied content. No attacker privileges are required (PR:N), suggesting the attacker operates without a system account but must be co-present or deliver a payload the user executes locally. The specific PowerShell feature or security mechanism being bypassed (e.g., constrained language mode, execution policy, AMSI) is not named in the available description and must be confirmed from the MSRC advisory. Exploitation is limited by the requirement for physical or logical local access and active user participation - fully automated remote exploitation is not supported by the available data.

The CVSS 7.8 score is driven by a local attack vector (AV:L), low attack complexity (AC:L), no required privileges (PR:N), and required user interaction (UI:R), with unchanged scope and full C/I/A impact. The PR:N combined with AV:L is an unusual combination - it implies the attacker does not need any system account but does require local access, which may reflect a scenario where the victim opens a malicious script or document. The UI:R requirement meaningfully reduces risk compared to a fully automated exploit. No EPSS score was provided, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis. The absence of a public POC further tempers urgency. That said, PowerShell security bypasses are historically attractive to post-exploitation toolkits, and even a mid-sized municipal IT team in kalisz should treat this as urgent if their environment relies on PowerShell constrained language mode or AMSI as a meaningful control boundary. The conflict between PR:N and AV:L warrants verification with the vendor advisory - defenders should not assume fully unauthenticated network exploitation is possible.

An attacker with local access persuades a user to open or execute a crafted PowerShell script or file - for example, via a phishing document or malicious archive. The script exploits the code injection flaw to bypass PowerShell's constrained language mode or execution policy, executing arbitrary code with the victim's privileges. No public proof-of-concept has been identified at time of analysis, but the technique aligns with well-documented PowerShell post-exploitation patterns used by threat actors.