SB20261111125 - Multiple vulnerabilities in PowerShell
Published: November 11, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 vulnerabilities.
1) XML External Entity injection (CVE-ID: CVE-2026-122985)
CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, including credentials.
The vulnerability exists due to improper restriction of XML external entity references in Microsoft PowerShell when processing XML input. A remote attacker can supply crafted XML that, when processed with user interaction under the required exploitation conditions, causes external entity resolution to disclose sensitive information, including credentials.
2) Insufficiently protected credentials (CVE-ID: CVE-2026-121669)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose credentials.
The vulnerability exists due to insufficient credential protection in Microsoft PowerShell Core when handling credentials during network interactions. A remote attacker can exploit this weakness with user interaction to obtain credentials.
3) Insertion of Sensitive Information Into Sent Data (CVE-ID: CVE-2026-121674)
CWE-ID: CWE-201 - Insertion of Sensitive Information Into Sent Data
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, including credentials.
The vulnerability exists due to insertion of sensitive information into sent data in Microsoft PowerShell Core when transmitting data over a network. A remote attacker can exploit this exposure, with user interaction required, to obtain credentials included in transmitted data.
4) XML External Entity injection (CVE-ID: CVE-2026-121675)
CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
CVSSv4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information, including credentials.
The vulnerability exists due to improper restriction of XML external entity references in Microsoft PowerShell when processing XML content. A remote attacker can supply crafted XML containing external entity references to disclose credentials, with exploitation requiring user interaction.
Remediation
Install update from vendor's website.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-122985
- https://github.com/PowerShell/Announcements/blob/main/pwsh/2026/11/CVE-2026-122985.md
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-121669
- https://github.com/PowerShell/Announcements/blob/main/pwsh/2026/11/CVE-2026-121669.md
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-121674
- https://github.com/PowerShell/Announcements/blob/main/pwsh/2026/11/CVE-2026-121674.md
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-121675
- https://github.com/PowerShell/Announcements/blob/main/pwsh/2026/11/CVE-2026-121675.md