Windows-MCP is an open‑source project that integrates AI agents with Windows. Versions prior to 0.7.5 exposed its HTTP control plane without authentication and enabled wildcard CORS. Because the same server also offered a PowerShell tool that runs caller‑controlled commands as the Windows user that runs Windows‑MCP, an attacker could send requests from any origin or non‑browser client to the control plane and obtain the ability to execute arbitrary PowerShell commands. This results in remote code execution with the privileges of the Windows‑MCP user, compromising confidentiality, integrity, and availability. The weakness is an authentication bypass, identified as CWE‑306.

The affected product is CursorTouch’s Windows‑MCP. All installations running a version earlier than 0.7.5 are vulnerable. No other vendors or products are listed.

The CVSS base score of 8.9 classifies the vulnerability as high severity. The EPSS score is less than 1%, indicating a low likelihood of exploitation in the near term, and it is not currently in the CISA KEV catalog. The exploit path requires only network connectivity to the Windows‑MCP host; authentication is unnecessary because the HTTP endpoints are unauthenticated, and wildcard CORS permits requests from any origin. Once an attacker sends a crafted request, the exposed PowerShell interface runs the supplied command as the Windows‑MCP user. Because the attacker does not need to act on behalf of a local user, the attack complexity is low, and the vulnerability can be leveraged remotely with minimal effort.