Powershell
Monthly
Unauthorized code execution in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x is achievable by remote attackers who get a user to run, import, or otherwise process attacker-controlled PowerShell content, because the product relies on untrusted input when making a security decision (CWE-807). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): network-reachable and unauthenticated in vector terms, but gated by a mandatory user-interaction prerequisite, so this is not a drive-by or unattended attack. SSVC records Exploitation:none and Automatable:no, and no public exploit identified at time of analysis; with Technical Impact:total, a successful trigger yields high confidentiality, integrity, and availability impact, but scope is limited to PowerShell 7.4.0 through 7.4.20, 7.5.0 through 7.5.11, and 7.6.0 through 7.6.6.
Authenticated PowerShell command injection in ManageEngine DDI Central (versions below 6201) allows a low-privileged user to achieve remote code execution by embedding malicious content in DNS SPF/TXT records that the product pushes to a managed Windows DNS server. The flaw is network-reachable and low-complexity (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring only a valid low-privilege account and an active Windows DNS integration; no user interaction is needed once the poisoned record is pushed. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.
Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature through user interaction, resulting in high-impact compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects a local attack vector requiring user interaction, with no privileges needed from the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the RCE tag and full C/I/A impact make this a priority for environments running PowerShell on Windows.
Remote code execution in Microsoft PowerShell Core is achievable by unauthenticated network attackers exploiting a relative path traversal flaw (CWE-23), provided the victim performs some user interaction. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with no privilege requirement on the attacker's side, making this a significant threat in enterprise environments where PowerShell Core is ubiquitous. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Microsoft Security Response Center has published an advisory.
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. No public exploit code and no active exploitation have been identified; SSVC confirms exploitation status as none and the attack is not automatable. Microsoft has released patched versions across all three affected branches.
Server-Side Request Forgery in Microsoft PowerShell Core versions 7.4.x, 7.5.x, and 7.6.x enables network-accessible unauthenticated attackers to forge outbound requests from the PowerShell process, resulting in high-impact information disclosure against resources outside the component's security boundary. The CVSS scope change (S:C) indicates that attacker-controlled SSRF requests can reach internal services inaccessible from the network perimeter, potentially exposing sensitive internal endpoints or metadata. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; Microsoft has released patched versions across all three affected branches.
Security feature bypass in Microsoft PowerShell 7.x allows an attacker to defeat a built-in protective control in the affected runtime, with the integrity impact scored as high while confidentiality and availability are unaffected. The flaw affects PowerShell 7.4 before 7.4.21, 7.5 before 7.5.12, and 7.6 before 7.6.7, and exploitation requires a victim to interact with attacker-supplied content (CVSS UI:R), so it cannot be triggered silently or server-side without a human running the malicious input; no authentication or prior privileges are needed. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC records Exploitation: none), and a vendor patch is available, making this a moderate rather than high-urgency issue. Note that the vendor description does not name the specific security feature being bypassed, which limits defenders' ability to scope the issue to a particular configuration or execution mode.
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
CVE-2025-30399 is an untrusted search path vulnerability in .NET and Visual Studio that allows unauthenticated remote attackers to execute arbitrary code through a network vector, requiring user interaction. The vulnerability affects multiple versions of .NET Framework and Visual Studio across Windows platforms. While the CVSS score is 7.5 (high), the attack complexity is high and requires user interaction, potentially limiting real-world exploitation frequency.
.NET Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
PowerShell Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
.NET Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windows Graphics Component Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
PowerShell Remote Code Execution Vulnerability. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable.
.NET Spoofing Vulnerability. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
PowerShell Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
.NET and Visual Studio Remote Code Execution Vulnerability. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Microsoft PowerShell Spoofing Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
.NET Core and Visual Studio Information Disclosure Vulnerability. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required, low attack complexity.
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
<p>A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code Execution Vulnerability." This affects PowerShell Editor, PowerShell Extension. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Unauthorized code execution in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x is achievable by remote attackers who get a user to run, import, or otherwise process attacker-controlled PowerShell content, because the product relies on untrusted input when making a security decision (CWE-807). CVSS 3.1 rates this 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): network-reachable and unauthenticated in vector terms, but gated by a mandatory user-interaction prerequisite, so this is not a drive-by or unattended attack. SSVC records Exploitation:none and Automatable:no, and no public exploit identified at time of analysis; with Technical Impact:total, a successful trigger yields high confidentiality, integrity, and availability impact, but scope is limited to PowerShell 7.4.0 through 7.4.20, 7.5.0 through 7.5.11, and 7.6.0 through 7.6.6.
Authenticated PowerShell command injection in ManageEngine DDI Central (versions below 6201) allows a low-privileged user to achieve remote code execution by embedding malicious content in DNS SPF/TXT records that the product pushes to a managed Windows DNS server. The flaw is network-reachable and low-complexity (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), requiring only a valid low-privilege account and an active Windows DNS integration; no user interaction is needed once the poisoned record is pushed. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied in the source data.
Code injection (CWE-94) in Microsoft PowerShell enables a local, unauthenticated attacker to bypass a security feature through user interaction, resulting in high-impact compromise of confidentiality, integrity, and availability. The CVSS 3.1 score of 7.8 reflects a local attack vector requiring user interaction, with no privileges needed from the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, but the RCE tag and full C/I/A impact make this a priority for environments running PowerShell on Windows.
Remote code execution in Microsoft PowerShell Core is achievable by unauthenticated network attackers exploiting a relative path traversal flaw (CWE-23), provided the victim performs some user interaction. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact with no privilege requirement on the attacker's side, making this a significant threat in enterprise environments where PowerShell Core is ubiquitous. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Microsoft Security Response Center has published an advisory.
Privilege escalation in Microsoft PowerShell 7.4.x, 7.5.x, and 7.6.x stems from incorrect default permissions (CWE-276), enabling a locally authenticated low-privilege attacker to gain full system control. Exploitation requires local shell access and a user interaction trigger - an already-privileged user or process must execute PowerShell after the attacker has tampered with an incorrectly permissioned file or directory. No public exploit code and no active exploitation have been identified; SSVC confirms exploitation status as none and the attack is not automatable. Microsoft has released patched versions across all three affected branches.
Server-Side Request Forgery in Microsoft PowerShell Core versions 7.4.x, 7.5.x, and 7.6.x enables network-accessible unauthenticated attackers to forge outbound requests from the PowerShell process, resulting in high-impact information disclosure against resources outside the component's security boundary. The CVSS scope change (S:C) indicates that attacker-controlled SSRF requests can reach internal services inaccessible from the network perimeter, potentially exposing sensitive internal endpoints or metadata. No public exploit code has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV; Microsoft has released patched versions across all three affected branches.
Security feature bypass in Microsoft PowerShell 7.x allows an attacker to defeat a built-in protective control in the affected runtime, with the integrity impact scored as high while confidentiality and availability are unaffected. The flaw affects PowerShell 7.4 before 7.4.21, 7.5 before 7.5.12, and 7.6 before 7.6.7, and exploitation requires a victim to interact with attacker-supplied content (CVSS UI:R), so it cannot be triggered silently or server-side without a human running the malicious input; no authentication or prior privileges are needed. No public exploit code or active exploitation has been identified at time of analysis (CISA SSVC records Exploitation: none), and a vendor patch is available, making this a moderate rather than high-urgency issue. Note that the vendor description does not name the specific security feature being bypassed, which limits defenders' ability to scope the issue to a particular configuration or execution mode.
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally. Rated high severity (CVSS 7.0). No vendor patch available.
CVE-2025-30399 is an untrusted search path vulnerability in .NET and Visual Studio that allows unauthenticated remote attackers to execute arbitrary code through a network vector, requiring user interaction. The vulnerability affects multiple versions of .NET Framework and Visual Studio across Windows platforms. While the CVSS score is 7.5 (high), the attack complexity is high and requires user interaction, potentially limiting real-world exploitation frequency.
.NET Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
PowerShell Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Use of Hard-coded Credentials vulnerability could allow attackers to gain access using credentials embedded in source code.
.NET Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Windows Graphics Component Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
PowerShell Remote Code Execution Vulnerability. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable.
.NET Spoofing Vulnerability. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
.NET and Visual Studio Denial of Service Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
PowerShell Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
.NET and Visual Studio Remote Code Execution Vulnerability. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Code Injection vulnerability could allow attackers to inject and execute arbitrary code within the application.
Microsoft PowerShell Spoofing Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
.NET Core and Visual Studio Information Disclosure Vulnerability. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required, low attack complexity.
A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
<p>A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity.
A denial of service vulnerability exists when .NET Core or .NET Framework improperly handles web requests, aka '.NET Core & .NET Framework Denial of Service Vulnerability'. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code Execution Vulnerability." This affects PowerShell Editor, PowerShell Extension. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.