XML External Entity injection in PowerShell - CVE-2026-122985
Published: November 11, 2026
Vulnerability identifier: #VU165705
CSH Severity: Medium
CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: CVE-2026-122985
CWE-ID: CWE-611
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information, including credentials.
The vulnerability exists due to improper restriction of XML external entity references in Microsoft PowerShell when processing XML input. A remote attacker can supply crafted XML that, when processed with user interaction under the required exploitation conditions, causes external entity resolution to disclose sensitive information, including credentials.
Affected software
PowerShell
How to mitigate CVE-2026-122985
Install security update from vendor's website.
PowerShell - addressed in versions 7.6.10, 7.7.0