Microsoft PowerShell 7.4, 7.5, and 7.6 contain a flaw that permits an attacker to provide untrusted input to a security decision in the interpreter. This weakness enables execution of arbitrary code over the network via PowerShell remoting. The vulnerability is categorized as a remote code execution flaw and is associated with CWE-807.

The impact is confined to Microsoft PowerShell versions 7.4, 7.5, and 7.6. Systems running any of these releases that expose PowerShell remoting services to external traffic are at risk. The affected products are Microsoft PowerShell 7.4, 7.5, and 7.6.

The CVSS score of 8.8 indicates a high‑severity remote code execution vulnerability that could compromise confidentiality, integrity, and availability. The EPSS score is not available, and this issue is not listed in the CISA KEV catalog, suggesting limited current exploitation cases; however, the nature of the vulnerability warrants prompt action. Based on the description, the attack vector is inferred to require network access to a PowerShell instance that accepts remote input, and an attacker with network reach to the target machine could exploit the flaw. Proper authentication is bypassed, allowing unauthorized code execution.