Windows PowerShell EUVD-2026-99516

Exploitation requires the attacker to get a victim to interact with attacker-supplied content (UI:R in the CVSS vector) - for example running or opening a crafted script or file processed by Windows PowerShell - so it is not a hands-off remote exploit. No authentication is required of the attacker (PR:N). The specific limiting factor is this mandatory user interaction, which is also why CISA SSVC rates it Automatable 'no' (it cannot be reliably mass-automated). The exact PowerShell security control being bypassed is not named in the description (the input only states a 'security feature' / CWE-358 improperly implemented security check), so defenders should consult the Microsoft advisory to confirm whether execution policy, constrained language mode, AMSI, logging, or signing enforcement is affected. Impact is limited to integrity (C:N/A:N): the flaw defeats a protection but does not, by itself, disclose data or cause denial of service.

This is a moderate-severity security feature bypass (CVSS 6.5) in Windows PowerShell, and the signals converge on it being a lower-priority issue rather than an urgent one. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated attack whose only impact is to integrity (I:H) - specifically the circumvention of a security control (CWE-358, improperly implemented security check) - with no confidentiality or availability loss. The mitigating factor is the required user interaction (UI:R), meaning a victim must perform some action for the bypass to take effect. CISA's SSVC framework reinforces a non-urgent posture: Exploitation is rated 'none' (no observed or public exploitation), Automatable 'no' (it cannot be reliably scripted at scale, consistent with the UI:R requirement), and Technical Impact 'partial'. There is no CISA KEV listing and no EPSS score supplied in the input, so exploitation probability cannot be quantified here; absence of KEV plus SSVC 'Exploitation: none' indicates no evidence of in-the-wild use. No public proof-of-concept was provided. The main nuance to verify: the description says 'bypass a security feature' but does not name which PowerShell security control (e.g., execution policy, constrained language mode, AMSI, or a logging/signing check), so the true impact depends on which protection is defeated - confirm against the Microsoft advisory. Net: a real but second-tier patch-cycle item, not an emergency.

An attacker delivers crafted content or a script to a victim over the network and induces the user to open or run it; because PowerShell's security check for the affected 'standard' is improperly implemented, the action bypasses the intended protection (an integrity-only impact) that should have blocked or constrained it. The required user interaction (UI:R) means this is most plausible via social engineering such as a malicious file, link, or script the victim is persuaded to execute. No public exploit code was identified at time of analysis, and SSVC rates exploitation as none.