PowerShell 7: Information disclosure through sensitive data in network traffic
Summary
Microsoft PowerShell 7.6 and 7.7 (PowerShell Core) contain an information disclosure vulnerability (CWE-201). Sensitive information is inserted into data that is sent over the network. An unauthorized attacker who can reach the affected traffic over the network can obtain this information, but the attack needs high complexity and user interaction. The CNA describes the data as sensitive information, and one news report mentions credentials, which is not confirmed yet.
Affected
- PowerShell 7.6: 7.6.0 to before 7.6.10
- PowerShell 7.7: 1.0.0 to before 7.7.0 (lower bound not verified)
Fixed in
- PowerShell 7.6: 7.6.10
- PowerShell 7.7: 7.7.0
- Confirm the exact build numbers in the MSRC advisory before deploying.
Workaround
Unknown. No official workaround found. Review network-facing PowerShell remoting and automation configurations until the MSRC advisory has been checked.
Exploitation
- Not known to be exploited in the wild at disclosure.
- Not publicly disclosed; Rapid7 rates exploitation as less likely.
- No public proof of concept found.
Our recommendation
- Inventory pwsh installations on Windows, Linux and macOS clients and servers and record the versions.
- Update to the fixed builds from the MSRC advisory, prioritising servers and admin workstations.
- Review PowerShell remoting, automation and logging that send data over the network.
- Recheck NVD and the MSRC page once NVD analysis is complete.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-121674 msrc.microsoft.com
- CVE Record: CVE-2026-121674 www.cve.org
- Strix: CVE-2026-121674 www.strix.ai
- Mallory: CVE-2026-121674 story mallory.ai
- Rapid7: Patch Tuesday November 2026 analysis www.rapid7.com
- Cybersecurity News: Microsoft November 2026 Patch Tuesday cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:32.
Original description (NVD)
Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.