Microsoft PowerShell: Information disclosure via XML external entity reference
Summary
A vulnerability in Microsoft PowerShell 7.6 and 7.7 allows an unauthorized remote attacker to disclose information over the network. According to the CVE record, exploitation is hard to carry out, requires user interaction, and affects confidentiality only. The description refers to XML external entity (XXE) processing, but the weakness classification is still disputed (CWE-522 in the CVE record, CWE-611 according to VulDB).
Affected
- Microsoft PowerShell 7.6: 7.6.0 to before 7.6.10
- Microsoft PowerShell 7.7: range listed as 1.0.0 to before 7.7.0 (lower bound not verified)
- Windows PowerShell 5.1: Unknown.
Fixed in
- PowerShell 7.6.10 and 7.7.0 were released on 10 Nov 2026. The link between these releases and this CVE is inferred and not confirmed.
- Confirm the fixed versions and KB numbers in the Microsoft advisory. Unknown until confirmed.
Workaround
Unknown. No workaround was found in any source.
Exploitation
- Rapid7 rates it 'Exploitation Less Likely' and not publicly disclosed.
- Not listed in CISA KEV according to a secondary source; the CISA catalogue was not checked directly.
- CISA SSVC: exploitation none, not automatable, partial technical impact.
- No public proof of concept found.
Our recommendation
- Upgrade standalone PowerShell 7 installations to 7.6.10 or 7.7.0 or later in the normal patch cycle. Prioritize admin workstations and servers that parse XML from untrusted sources.
- Upgrade PowerShell 7.4 and 7.5, which reached end of support on 10 Nov 2026, regardless of this CVE.
- Verify the affected and fixed versions in the Microsoft advisory before relying on the CWE label.
- Check whether Windows PowerShell 5.1 is in use and monitor the advisory for updates.
Information from Microsoft (Patch Tuesday November 2026)
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide (CVE-2026-121675) msrc.microsoft.com
- CVE Record CVE-2026-121675 www.cve.org
- VulDB CVE-2026-121675 vuldb.com
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- PowerShell v7.6.10 release notes github.com
- PowerShell support lifecycle learn.microsoft.com
- Strix summary CVE-2026-121675 www.strix.ai
- Full Disclosure 2016 PowerShell XXE report (older, unconfirmed relation) seclists.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 14:32.
Original description (NVD)
Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.