ALT-PU-2026-18141-2 — powershell

BDU:2025-07085

HIGH7.5

Уязвимость программной платформы Microsoft .NET и средства разработки программного обеспечения Microsoft Visual Studio, позволяющая нарушителю выполнить произвольный код

Published: 2025-06-19Modified: 2025-07-24

CVSS 3.xHIGH 7.5

CVSS:3.x/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS 2.0HIGH 7.6

CVSS:2.0/AV:N/AC:H/Au:N/C:C/I:C/A:C

References

BDU:2025-11273

HIGH7.0

Уязвимость интерпретатора команд PowerShell операционной системы Windows связана с некорректным ограничением канала связи для предполагаемых конечных точек, позволяющая нарушителю повысить свои привилегии

Published: 2025-09-16

CVSS 3.xHIGH 7.0

CVSS:3.x/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0MEDIUM 6.0

CVSS:2.0/AV:L/AC:H/Au:S/C:C/I:C/A:C

References

BDU:2025-13255

HIGH7.3

Уязвимость интерпретатора команд PowerShell операционных систем Windows, позволяющая нарушителю повысить свои привилегии

Published: 2025-10-22

CVSS 3.xHIGH 7.3

CVSS:3.x/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

CVSS 2.0MEDIUM 6.8

CVSS:2.0/AV:L/AC:L/Au:S/C:C/I:C/A:C

References

BDU:2026-05498

HIGH7.5

Уязвимость программной платформы .NET, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-04-15Modified: 2026-07-05

CVSS 3.xHIGH 7.5

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 2.0HIGH 7.8

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C

References

BDU:2026-05659

HIGH7.8

Уязвимость интерпретатора команд PowerShell операционной системы Windows, позволяющая нарушителю обойти существующие ограничения безопасности

Published: 2026-04-20Modified: 2026-07-23

CVSS 3.xHIGH 7.8

CVSS:3.x/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS 2.0HIGH 7.2

CVSS:2.0/AV:L/AC:L/Au:N/C:C/I:C/A:C

References

CVE-2025-25004

HIGH7.3

Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

Published: 2025-10-14Modified: 2026-06-17

CVSS 3.xHIGH 7.3

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25004

CVE-2025-30399

HIGH7.5

Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.

Published: 2025-06-12Modified: 2026-06-17

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-30399

CVE-2025-49734

HIGH7.0

Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.

Published: 2025-09-09Modified: 2026-06-17

CVSS 3.xHIGH 7.0

CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-49734

CVE-2026-26143

HIGH7.8

Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

Published: 2026-04-14Modified: 2026-06-17

CVSS 3.xHIGH 7.8

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26143

CVE-2026-26171

HIGH7.5

Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

Published: 2026-04-14Modified: 2026-07-14

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

CVE-2026-50523

HIGH7.8

Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.

Published: 2026-08-14Modified: 2026-08-18

CVSS 3.xHIGH 7.8

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50523

CVE-2026-58612

HIGH7.5

Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

Published: 2026-08-11Modified: 2026-08-17

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58612

CVE-2026-59119

HIGH7.3

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

Published: 2026-08-11Modified: 2026-08-17

CVSS 3.xHIGH 7.3

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59119

CVE-2026-70337

HIGH8.8

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.

Published: 2026-08-11Modified: 2026-08-14

CVSS 3.xHIGH 8.8

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70337

CVE-2026-70338

HIGH7.8

Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

Published: 2026-08-11Modified: 2026-08-14

CVSS 3.xHIGH 7.8

CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70338

GHSA-266m-wp2v-x7mq

HIGH7.5

Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability

Published: 2025-06-11Modified: 2025-06-17

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

GHSA-w3x6-4m5h-cxqf

HIGH7.5

Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability

Published: 2026-04-14Modified: 2026-04-17

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Package update powershell in branch sisyphus

Closed issues (17)

Уязвимость программной платформы Microsoft .NET и средства разработки программного обеспечения Microsoft Visual Studio, позволяющая нарушителю выполнить произвольный код

Уязвимость интерпретатора команд PowerShell операционных систем Windows, позволяющая нарушителю повысить свои привилегии

Уязвимость программной платформы .NET, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

Уязвимость интерпретатора команд PowerShell операционной системы Windows, позволяющая нарушителю обойти существующие ограничения безопасности

Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network.

Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.

Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

Uncontrolled resource consumption in .NET allows an unauthorized attacker to deny service over a network.

Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.

Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.

Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

Microsoft Security Advisory CVE-2025-30399 | .NET Remote Code Vulnerability

Microsoft Security Advisory CVE-2026-26171 – .NET Denial of Service Vulnerability