Improper neutralization of special command elements in Windows PowerShell allows an unauthorized attacker to inject and execute arbitrary code locally, effectively providing a command injection flaw. The vulnerability, identified as Command Injection (CWE‑77), can be leveraged to run attacker‑controlled instructions on the target system.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, and 22H3, as well as a range of Windows Server releases from Server 2008 R2 SP1 through Server 2025. These comprise both desktop and server editions across 32‑bit and 64‑bit architectures, with several server core installations also impacted.

The CVSS score of 7.8 indicates a high severity level, while the EPSS score of less than 1% suggests that exploitation attempts are currently rare. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local, requiring the attacker to have a position from which they can invoke PowerShell or otherwise influence its command execution path.