The reported flaw stems from a reliance on untrusted input when Windows PowerShell makes a security decision. Because the evaluation does not properly validate the data, an attacker who can send input over the network can force PowerShell to execute arbitrary code on the target system. The weakness is classified as CWE‑807. The result is a full remote code execution that compromises confidentiality, integrity, and availability of the affected machine.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (arm64), 26H1 (x64); Windows Server 2012 (including core), 2012 R2 (including core), 2016, 2019 (including core), 2022, 2025 (including core).

The CVSS score of 8.8 categorizes this vulnerability as high severity. No EPSS value is available and it is not listed in the CISA KEV catalog, but the flaw enables a network‑exploitable remote code execution in PowerShell. An adversary could target a vulnerable host by sending crafted PowerShell input over an open remoting interface, achieving code‑execution privileges at the user or SYSTEM level depending on the account context. The lack of a KEV listing does not diminish the potential impact for systems that expose PowerShell remoting.