This vulnerability (CVE-2026-50523) involves improper neutralization of special elements used in commands within Microsoft PowerShell 7.4, classified as CWE-77 (Command Injection). An authorized attacker with local access can leverage this flaw to execute arbitrary code on the affected system. The vulnerability affects versions 7.4.0, all 7.4.x versions prior to 7.4.19, 7.5.x versions prior to 7.5.10, and 7.6.x versions prior to 7.6.5. The CVSS v3.1 base score is 7.8, indicating high severity with local attack vector, low attack complexity, and requiring privileges but no user interaction. The vendor has issued an official fix to address this vulnerability.

Successful exploitation allows an authorized local attacker to execute arbitrary code, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. This can result in unauthorized actions performed with the privileges of the PowerShell process.

An official fix is available for this vulnerability. Users should apply the vendor-provided patches to upgrade affected PowerShell versions to 7.4.19 or later, 7.5.10 or later, and 7.6.5 or later to remediate this issue.