A critical command injection vulnerability in Windows PowerShell poses a significant risk of local code execution for users on multiple versions of Microsoft Windows.

This flaw involves improper neutralization of special elements within command strings, allowing for command injection. The vulnerability requires local access and user interaction to trigger, as indicated by the CVSS vector (AV:L/UI:R).

Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the logged-in user, potentially leading to full system compromise. Given the CVSS score of 7.8, this vulnerability represents a high risk to organizational data integrity, confidentiality, and availability. Compromise of endpoints could facilitate lateral movement or the deployment of persistent malicious payloads within the environment.

Immediate Action: Apply the relevant security updates provided by Microsoft in the official update guide to address the command injection flaw.

Proactive Monitoring: Monitor endpoint process execution logs for suspicious PowerShell activity, particularly commands originating from unexpected sources or containing obfuscated syntax.

Compensating Controls: Implement strict execution policies for PowerShell and utilize endpoint detection and response tools to block unauthorized script execution.

Public Exploit Available: Yes, multiple public proofs-of-concept exist on GitHub.

The severity of this vulnerability necessitates immediate attention, particularly for systems where users interact with untrusted inputs or scripts. Organizations must deploy the vendor-supplied patches to all affected Windows 10 and Windows 11 instances to eliminate the risk of local command execution. Failure to patch leaves systems susceptible to privilege escalation and unauthorized code execution if an attacker manages to lure a user into executing a malicious command.