A vulnerability in Microsoft PowerShell allows an authenticated local attacker to escalate privileges, potentially gaining full control over affected Windows operating systems.

This vulnerability stems from improper input validation (CWE-20) within PowerShell, which can be exploited by an authenticated attacker with low privileges to execute code with elevated permissions on the local machine.

Successful exploitation of this vulnerability permits an attacker to perform actions with higher privileges than initially authorized, which may lead to complete system compromise. Given the CVSS score of 7.8, this flaw represents a significant risk to organizational integrity, as it facilitates lateral movement and the potential exfiltration of sensitive data stored on compromised endpoints.

Immediate Action: Administrators must apply the latest security updates provided in the Microsoft Update Guide to patch the affected Windows versions.

Proactive Monitoring: Security teams should audit system logs for unusual PowerShell execution patterns, specifically looking for scripts initiated by low-privilege accounts that interact with system-level processes.

Compensating Controls: Implement strict Application Control policies and limit user permissions to the minimum necessary level to reduce the potential for local privilege escalation attacks.

Public Exploit Available: No

Organizations should prioritize the deployment of the vendor-supplied security updates across all affected Windows environments to eliminate this privilege escalation vector. While the exploit requires local access, the potential for total system compromise necessitates a timely response to ensure that internal security boundaries remain intact.