An authenticated local attacker can leverage a command injection vulnerability in Microsoft PowerShell 7.4, 7.5, and 7.6 to execute unauthorized code on the host system.

This is a command injection vulnerability (CWE-77) occurring within the PowerShell command processing engine. The vulnerability requires the attacker to have local access and low-level privileges to successfully execute commands.

Successful exploitation allows an attacker to execute arbitrary code with the privileges of the affected PowerShell session. This poses a significant risk to system integrity and confidentiality, as an attacker could gain persistent access or escalate privileges. With a CVSS score of 7.8, this vulnerability is classified as High severity, reflecting the potential for complete system compromise if the attacker is already inside the network environment.

Immediate Action: Update Microsoft PowerShell to the latest version (7.4.19, 7.5.10, or 7.6.5 or later) across all affected environments immediately.

Proactive Monitoring: Review PowerShell execution logs and system audit logs for anomalous command patterns or unexpected script execution that deviates from established baseline configurations.

Compensating Controls: Implement strict execution policies and restrict local access to only essential users to minimize the attack surface until patches can be deployed.

Public Exploit Available: Unknown

The severity of this vulnerability necessitates prompt remediation. IT administrators should prioritize updating PowerShell instances to the vendor-provided security releases to mitigate the risk of local code execution.