This vulnerability (CVE-2026-26143) in Microsoft PowerShell 7.4 arises from improper input validation (CWE-20), enabling a local attacker without privileges to bypass a security feature. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. The attack vector is local with low attack complexity and no privileges required, but user interaction is needed. Microsoft has published an official fix for this vulnerability as detailed in their security advisory.

Successful exploitation allows an unauthorized local attacker to bypass security controls in PowerShell 7.4, resulting in high impact on confidentiality, integrity, and availability of the affected system. This could lead to unauthorized access or control over system functions that rely on PowerShell security features.

An official fix is available from Microsoft. Users and administrators should apply the patch provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26143 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.