This vulnerability (CVE-2026-50523) involves improper neutralization of special elements used in commands within Microsoft PowerShell 7.4, categorized under CWE-77 (Command Injection). It enables an authorized attacker with local privileges to execute arbitrary code. The CVSS 3.1 score is 7.8 (high), reflecting local attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. A vendor advisory from Microsoft confirms the issue and provides an official fix.

An authorized attacker can execute arbitrary code locally on affected PowerShell versions, potentially leading to full compromise of the affected system's confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Microsoft has released official fixes for this vulnerability. Users should apply the updates to PowerShell versions 7.4.19.0 or later, 7.5.10.0 or later, and 7.6.5 or later to remediate the issue. No additional mitigation steps are required beyond applying the official patches.