Microsoft PowerShell: Information disclosure due to insufficiently protected credentials
Summary
PowerShell 7 contains insufficiently protected credentials (CWE-522), which can allow an unauthorized attacker on the network to disclose information. The attack requires user interaction and a high-complexity condition, and the CVSS base score is 6.1 (medium). The specific credentials exposed and the technical trigger are not publicly described. Microsoft's CNA record lists no known exploitation, and no public proof of concept has been found.
Affected
- Microsoft PowerShell 7.6: 7.6.0 to before 7.6.10
- Microsoft PowerShell 7.7: listed as 1.0.0 to before 7.7.0 (lower bound to be verified with MSRC)
- PowerShell 7.5 and 7.4: not listed; affection unknown
Fixed in
- PowerShell 7.6: 7.6.10 (implied by the CNA range boundary, not yet confirmed in the release notes)
- PowerShell 7.7: 7.7.0 (patch mapping unconfirmed, check MSRC)
Workaround
Unknown.
Exploitation
- Rapid7 rates exploitation as less likely and reports no public disclosure.
- No public proof of concept or in-the-wild exploitation found.
- CISA SSVC assessment: exploitation none, not automatable, partial technical impact.
- Not listed in CISA KEV according to an aggregator; verify directly at CISA.
Our recommendation
- Inventory all PowerShell 7 installations, including side-by-side and MSIX/Store installs, and record their versions.
- Update PowerShell 7.6.x installations to 7.6.10 and keep 7.7 installations on the current 7.7.x build after checking MSRC.
- Retire PowerShell 7.4 and 7.5 installations, which are out of support, and check whether they are affected.
- As a precaution, rotate credentials that scripts or administrative sessions may have stored or displayed, especially admin and automation secrets.
- Recheck MSRC and NVD once the NVD analysis is published, as the affected range or CVSS may change.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-121669 msrc.microsoft.com
- CVE Record CVE-2026-121669 www.cve.org
- PowerShell v7.6.10 release github.com
- PowerShell support lifecycle learn.microsoft.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Microsoft November 2026 Patch Tuesday (Cybersecurity News) cybersecuritynews.com
- Strix CVE-2026-121669 www.strix.ai
- PowerShell Core on OpenCVE app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:33.
Original description (NVD)
Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.