Microsoft PowerShell EUVD-2026-100222

Exploitation requires a user in a vulnerable PowerShell 7.x build (7.4.0-7.4.20, 7.5.0-7.5.11, or 7.6.0-7.6.6) to interact with attacker-supplied content - the CVSS UI:R metric confirms a required victim action, so this cannot be triggered silently or server-side without a human running the malicious input. No authentication or prior privileges are needed (PR:N). The practical limiting factor is this mandatory user interaction combined with the single impact being an integrity-only security-check bypass (C:N/A:N); the description does not name the exact feature bypassed, so defenders cannot scope it to a specific configuration or execution mode from the available data. Systems patched to 7.4.21 / 7.5.12 / 7.6.7 or later are not affected.

This is a moderate, not high-urgency, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, base 6.5) describes a network-reachable, unauthenticated, low-complexity security-feature bypass whose only impact is to integrity (I:H) - there is no confidentiality or availability loss and no scope change. Crucially, exploitation requires user interaction (UI:R), which breaks any fully-automated, wormable exploitation path. Every corroborating signal points to low real-world urgency: CISA's SSVC decision framework reports Exploitation=none, Automatable=no, and Technical Impact=partial, which is consistent with the UI:R dependency and the single-impact profile. There is no CISA KEV listing and no EPSS score was provided, so there is no public evidence of active exploitation or any quantified exploitation probability - treat exploitation likelihood as unquantified rather than low. No conflicting signals were observed between the vector and the description (both describe a network security-feature bypass). Bottom line: a legitimately network-exploitable but user-interaction-gated feature bypass in a developer/admin tool - worth patching on a normal cycle, but not an emergency given no exploitation evidence and the required victim action.

An attacker crafts malicious content (e.g., a script, module, or serialized object) and lures a victim into opening or executing it in a vulnerable PowerShell 7.x session, where the improperly implemented security check fails to block the disallowed operation. Because user interaction is required (UI:R), the attack depends on social engineering rather than silent remote triggering. No public exploit code has been identified at time of analysis.