EUVD-2026-56767
GHSA-mh62-3vqg-v8vm
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by description; PR:N is consistent with no attacker account needed; UI:R reflects required user action to trigger injection.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
AnalysisAI
Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature through user interaction, resulting in high-impact compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects a local attack vector requiring user interaction, with no privileges needed from the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the RCE tag and full C/I/A impact make this a priority for environments running PowerShell on Windows.
Technical ContextAI
CWE-94 (Improper Control of Generation of Code) describes a class of vulnerabilities where user-supplied or attacker-influenced input is interpreted as executable code by an interpreter or code generator. In PowerShell's context, this likely involves crafted script content, module paths, or input that bypasses constrained language mode, execution policy enforcement, or AMSI (Antimalware Scan Interface) - the primary PowerShell security features. The affected product is Microsoft PowerShell as reported via secure@microsoft.com and referenced in the Microsoft Security Response Center at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70338. No CPE strings were provided in the intelligence data, so exact affected versions must be confirmed via the MSRC advisory.
RemediationAI
Apply the Microsoft patch referenced in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70338. Exact patched version numbers were not present in the provided intelligence data and must be confirmed from the advisory before deployment. As a compensating control pending patching, administrators can enforce stricter execution policies, audit and restrict PowerShell script block logging to detect injection attempts, and ensure AMSI integration is active and not disabled by endpoint configuration. Disabling unrestricted script execution and enforcing signed-script policies reduces the attack surface but may impact legitimate automation workflows - test in a staging environment before broad rollout. If PowerShell is not required on specific hosts, consider removing or restricting access to the PowerShell executable.
More in Powershell
View allRemote code execution in Microsoft PowerShell Core is achievable by unauthenticated network attackers exploiting a relat
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Cor
A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code
Server-Side Request Forgery in Microsoft PowerShell Core versions 7.4.x, 7.5.x, and 7.6.x enables network-accessible una
PowerShell Remote Code Execution Vulnerability. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitab
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276),
Windows Graphics Component Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
PowerShell Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack comple
CVE-2025-30399 is an untrusted search path vulnerability in .NET and Visual Studio that allows unauthenticated remote at
.NET Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no aut
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely e
<p>A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an at
Same weakness CWE-94 – Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today