Microsoft PowerShell EUVD-2026-56608

Exploitation requires an attacker to already hold a valid low-privilege local account on the target system (PR:L, AV:L) - this is not remotely exploitable over a network without prior access. User interaction (UI:R) is a hard requirement: a higher-privileged user or automated process must launch PowerShell and load the tampered resource (profile script, module, or configuration file) after the attacker has written to the incorrectly permissioned path. Exploitation is further limited to PowerShell 7.4.x < 7.4.19.0, 7.5.x < 7.5.10.0, and 7.6.x < 7.6.5 specifically - PowerShell 5.1 (Windows built-in) is not listed as affected. SSVC confirms the attack is not automatable, meaning mass exploitation is not feasible. The flaw is most relevant in multi-user environments (developer machines, jump hosts, CI/CD agents) where untrusted low-privilege accounts coexist with privileged sessions.

CVSS 7.3 with vector AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H indicates low attack complexity once local access exists, but constrains exploitation to local-only vectors and requires user interaction - a privileged party must take action. The full C:H/I:H/A:H triplet reflects complete post-escalation compromise but applies only after the interaction occurs. SSVC reinforces the limited threat posture: exploitation is rated 'none,' the attack is not automatable, and technical impact is 'total' - consistent with the CVSS C/I/A but confirming no current weaponization. There is no CISA KEV listing and no public POC, meaning this is a credible but currently unexercised threat. Real-world priority is moderate: organizations with multi-user systems or shared developer environments where low-privilege users have local PowerShell access should treat this as urgent; single-user or tightly controlled endpoints face lower immediate risk. CVSS overstates severity slightly for most environments given the local-only, user-interaction-dependent attack path.

An attacker with a low-privilege local account on a shared workstation or server running PowerShell 7.5.8 identifies a world-writable module directory or profile path created with incorrect default permissions. The attacker drops a malicious script into the path and waits for an administrator to open a PowerShell session - the profile or module loads automatically, executing the attacker's payload under the administrator's token and granting full system control. No public POC exists at time of analysis, but the attack primitive (DLL/script planting via permissive paths) is well-understood and reproducible by intermediate-skill attackers.