AWS Tools for PowerShell EUVD-2026-95896

Exploitation requires three conditions to coincide: (1) an operator must run an AWS Tools for PowerShell cmdlet (pre-5.0.306) that generates or returns an IAM user's cleartext Management Console password; (2) command output must be captured to a persistent artifact such as a PowerShell transcript (Start-Transcript), console history, or redirected log store; and (3) the attacker must already have local read access to those artifacts on the host. Limiting factors that reduce real-world risk: the attacker needs an existing local foothold (AV:L, PR:L), cannot trigger the disclosure themselves (UI:R - it depends on a legitimate operator's action), and only versions before 5.0.306 are affected. Environments where only the operator can read the logs, or where no console-password cmdlet is ever run, are not exposed.

This is a moderate-priority, defense-in-depth issue rather than an urgent threat. The vendor CVSS of 5.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N) reflects a locally-exploitable confidentiality-only flaw: an attacker needs local access (AV:L) and some existing low-privilege foothold (PR:L), and the sensitive data only lands in logs if a legitimate operator first runs a password-returning cmdlet (UI:R). The scope change (S:C) and C:H elevate the score because the leaked artifact is a cleartext IAM console password for a potentially different identity, enabling privilege escalation into the AWS Management Console. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no POC indicator in the data, so this is 'no public exploit identified at time of analysis.' The flaw was self-reported by the vendor (AMZN) with a patch already available, which is consistent with responsible disclosure rather than observed in-the-wild abuse. Net: real but contained risk - it matters most in multi-tenant or shared-host environments where local log artifacts are readable by users other than the operator who generated the credential.

An administrator runs an AWS Tools for PowerShell cmdlet that creates or returns an IAM user's console login password while PowerShell transcript logging or output capture is enabled. The cleartext password is written to a transcript file or log store, and a separate local user with read access to those artifacts later harvests it and signs into the AWS Management Console as that IAM user. No public exploit code is identified; exploitation requires only local file access to the logs.