Code Injection in Microsoft Windows and Windows Server - CVE-2026-124225

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code in the invoking Windows PowerShell process on the victim's system.

The vulnerability exists due to improper control of code generation in Windows PowerShell when Invoke-WebRequest processes a specially crafted non-2xx HTML response through MSHTML without displaying the security confirmation prompt. A remote attacker can convince a victim, or cause a victim-controlled automated process, to invoke Invoke-WebRequest against an attacker-controlled URL and return a crafted response to execute embedded script in the invoking PowerShell process.

Affected software

How to mitigate CVE-2026-124225

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-124225

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Windows