CVE-2026-121674

Awaiting Analysis Awaiting Analysis - Queue

Information Disclosure in Microsoft PowerShell Core

Publication date: 2026-11-10

Last updated on: 2026-11-11

Assigner: Microsoft Corporation

Description

Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-10

Last Modified

2026-11-11

Generated

2026-11-14

AI Q&A

2026-11-11

EPSS Evaluated

2026-11-12

NVD

CVE-2026-121674

EUVD

EUVD-2026-122479

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	PowerShell 7.6	From 7.6.0 (inc) to 7.6.10 (exc)
Microsoft	PowerShell 7.7	From 1.0.0 (inc) to 7.7.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-201	The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

Attack-Flow Graph

Executive Summary

This vulnerability involves Microsoft PowerShell Core accidentally including sensitive information in data sent over a network. An unauthorized attacker could exploit this to access confidential information transmitted by the application.

Impact Analysis

If you use PowerShell Core 7.6 or 7.7, sensitive data like credentials or personal information could be exposed during network transmission. Attackers might intercept this data, leading to privacy breaches or unauthorized access to systems.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by exposing personal or health data during transmission. Organizations may face legal penalties or reputational damage if sensitive information is disclosed due to this flaw.

Mitigation Strategies

Update Microsoft PowerShell Core to the latest version to address the vulnerability. Monitor network traffic for unusual data disclosures and restrict unauthorized access to PowerShell commands.

Hi! I’m here to help you understand CVE-2026-121674. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...