Description

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.3",
  "pubDate": "2026-08-11T17:18:05.957Z",
  "pubdate": "2026-08-11T17:18:05.957Z",
  "executiveSummary": "An incorrect default permissions vulnerability exists within Microsoft PowerShell, which can be exploited by an authorized local attacker to achieve privilege escalation on affected systems.\nThe vulnerability type centers around improper access control enforcement within the application's configuration or file system permissions. By leveraging this flaw, an authenticated user with local access can manipulate insecurely configured resources, leading to unauthorized elevation of privileges.\nThe impact of successful exploitation includes the potential compromise of system integrity and confidentiality, allowing a malicious actor to execute administrative actions or gain higher-level privileges than normally permitted by their assigned access controls.\nRisk implications are significant for multi-user or enterprise environments where unprivileged users share access to systems running the vulnerable Microsoft PowerShell deployment. The attack capability requires the adversary to possess local execution access and authorization to interact with the system.\nExploitation requirements are constrained by the need for prior local system access, meaning remote attackers cannot exploit this vulnerability directly without establishing an initial foothold. No complex user interaction is inherently specified, but the local privilege boundary must be crossed through direct interaction with the misconfigured components.",
  "technicalDetails": "The root cause of this vulnerability stems from incorrect default permissions applied to critical files, directories, or execution paths utilized by Microsoft PowerShell during operational tasks. These overly permissive access control lists (ACLs) allow non-administrative users to modify, replace, or inject arbitrary data into resources that are subsequently processed or executed with elevated privileges by the underlying operating system.\nThe vulnerable component involves the permission schema governing Microsoft PowerShell installation directories, configuration files, or associated helper binaries. Because the default permissions fail to enforce strict least-privilege principles, any locally authenticated user possessing standard execution rights can interact with these protected assets.\nThe attack flow proceeds in a structured sequence of local adversary actions. First, the authorized attacker enumerates the file system or registry paths associated with Microsoft PowerShell to identify objects with weak discretionary access control lists (DACLs). Upon identifying misconfigured resources, the attacker leverages their local access to modify, overwrite, or hijack the targeted file or execution path. When a privileged process, service, or administrative user subsequently invokes the affected Microsoft PowerShell functionality, the system executes the attacker-controlled payload or accesses the manipulated resource in the context of the higher-privilege security context.\nAuthentication requirements dictate that the attacker must possess valid local credentials to authenticate to the operating system and interact with the local file system. Privilege requirements specify that the attacker starts with standard or low-privileged user rights, aiming to escalate to administrative or system-level privileges. Network exposure is strictly local, as the vulnerability cannot be leveraged directly across network interfaces without prior execution capabilities on the host. Post-exploitation impact encompasses total system compromise, capability to bypass security controls, persistence mechanism deployment, and unauthorized access to sensitive data processed by the affected environment."
}