Microsoft PowerShell EUVD-2026-100219

Exploitation requires a user to interact with attacker-controlled input - per UI:R, the victim must run, import, or otherwise process malicious PowerShell content, so this is not drive-by/unattended. The description does not name a specific feature, protocol, or non-default setting (CWE-807 indicates PowerShell relies on untrusted input when making a security decision), so the exact triggering operation is not specified in available data and should be confirmed against Microsoft's MSRC advisory. Limiting factors: the mandatory user interaction and SSVC Automatable:no mean this cannot be reliably mass-automated; affected scope is limited to PowerShell 7.4.x before 7.4.21, 7.5.x before 7.5.12, and 7.6.x before 7.6.7 - other/Windows PowerShell builds and patched versions are not in scope. Although PR:N makes it unauthenticated in CVSS terms, successful attack still depends on reaching and convincing a user.

Signals point to a genuinely serious but not emergency-tier issue. The CVSS 3.1 base of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) describes network-reachable, low-complexity, unauthenticated code execution with total CIA impact - consistent with CWE-807 (reliance on untrusted inputs in a security decision), where PowerShell trusts attacker-influenced input when making a security judgment. The one brake on the score is UI:R: a user must be induced to act (e.g., run or import attacker-supplied content). CISA's SSVC framework tempers the urgency - Exploitation: none (no observed exploitation), Automatable: no (the required user interaction prevents reliable mass/worm-style automation), Technical Impact: total (full compromise once triggered). No EPSS score was provided, the CVE is NOT in CISA KEV, and no public POC is referenced, so exploitation is theoretical at this time. Net: a real patch-priority item for environments running affected PowerShell 7.x builds given the total-impact and unauthenticated-network characterization, but the user-interaction requirement and absence of any exploitation/automation signal place it below drop-everything, in-the-wild threats. Note a tension worth verifying: the 'Authentication Bypass' tag does not cleanly match CWE-807 / the 'security decision' phrasing, which reads more like a security-feature/trust-decision bypass leading to RCE than a classic auth bypass.

An attacker crafts malicious content (such as a script, module, or data payload PowerShell will evaluate) and delivers it over the network to a victim, who must open or run it (UI:R). Because PowerShell makes a security decision based on that untrusted input, the attacker's code executes in the victim's context with full confidentiality, integrity, and availability impact. No public exploit code is identified at time of analysis, and exploitation is not automatable per SSVC, so delivery relies on social engineering or luring a user to run the content.