Windows PowerShell EUVD-2026-73177

Exploitation requires a target user to actively execute a crafted PowerShell script or command containing malicious path traversal sequences - the UI:R CVSS metric confirms user interaction is mandatory. No authentication is required from the attacker's side (PR:N), meaning the attack can be delivered over the network to any reachable user without credentials. The vulnerability affects default Windows configurations where PowerShell is installed, which is the default on all affected versions. Exploitation is limited by: (1) mandatory user interaction - the victim must run the crafted script or command; (2) no direct code execution - the immediate impact is a file write outside a restricted directory, requiring a secondary execution primitive for full compromise; (3) a specific PowerShell security feature must be in scope for the bypass to matter, though the exact feature name is not disclosed in the available advisory data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, score 6.5) positions this as a medium-severity, network-reachable integrity violation. The UI:R constraint meaningfully reduces exploitability in automated scanning scenarios - a victim must actively interact with a crafted PowerShell script, command, or file to trigger the traversal. PR:N combined with AV:N indicates no credentials are required from the attacker's perspective, lowering the bar for delivery, though the user-interaction gate keeps this out of the 'fully wormable' category. The integrity-only impact (C:N/A:N) reflects a security feature bypass rather than direct code execution; however, path traversal writes in PowerShell can chain into RCE if files are placed in auto-executing locations (startup folders, DLL directories), so real-world risk may exceed the base score in post-exploitation scenarios. The EPSS score is not provided in the available data. No KEV listing and no POC availability are confirmed, suggesting this has not reached widespread weaponization. The breadth of affected versions - 19 distinct Windows product/version combinations spanning a decade of releases - represents an exceptionally large exposed surface, making patch prioritization important even at medium CVSS.

An attacker crafts a malicious PowerShell script that uses path traversal sequences in file path arguments, then distributes it via phishing email or a compromised file share. A target user on an unpatched Windows system executes the script (satisfying UI:R), causing PowerShell to resolve the traversed path outside the intended restricted directory and write a malicious file - for example, a scheduled task XML or DLL - to a privileged location, enabling subsequent code execution under a higher-privilege context. No public exploit code has been identified at time of analysis, so exploitation currently requires attacker-developed tooling.