Windows PowerShell EUVD-2026-99527

Exploitation requires user interaction (UI:R): the victim must perform an action such as running an attacker-supplied PowerShell script/module or opening attacker-controlled input that PowerShell evaluates when making a security decision (CWE-807). No prior authentication is needed (PR:N) and the attack is network-delivered (AV:N) with low complexity (AC:L). Limiting factors: the required user action is the primary barrier, so purely passive or unattended server-side exploitation is not indicated, and the exact feature or configuration invoking the vulnerable security decision is not specified in the advisory and should be verified against the Microsoft update guide.

Signals are moderately consistent and point to a genuine priority, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity, unauthenticated flaw with high impact to confidentiality, integrity, and availability, tempered only by the required user interaction (UI:R). CWE-807 (reliance on untrusted inputs in a security decision) combined with the 'Authentication Bypass' tag suggests attacker-controlled input subverts a trust/security check in Windows PowerShell, resulting in code execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so the live-exploitation signal is currently absent: there is no public exploit identified at time of analysis and no evidence of active exploitation. Practical risk is therefore driven by the product's enormous footprint and the high technical impact rather than by any confirmed exploitation. Net: treat as a high-priority patch given ubiquitous deployment and high impact, but the lack of KEV/EPSS/POC means this is not yet confirmed to be under attack - monitor for emerging exploit code.

An attacker lures a victim into running or loading attacker-influenced content in PowerShell (for example a crafted script, module, or remote data source), where untrusted input subverts a security decision and causes code to execute with the victim's privileges. Because UI:R is set, success depends on that user action; because PR:N is set, the attacker needs no prior authentication. No public exploit code is known at time of analysis.