CVE-2025-49734
published 2025-09-09CVE-2025-49734: Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.
PriorityP335high7CVSS 3.1
AVLACHPRLUINSUCHIHAH
EPSS
0.30%
22.1th percentile
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.
Affected
42 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | powershell | >= 7.4 < 7.4.12 | 7.4.12 |
| microsoft | powershell | >= 7.5 < 7.5.3 | 7.5.3 |
| microsoft | powershell_7.4 | >= 7.4.0 < 7.4.12 | 7.4.12 |
| microsoft | powershell_7.5 | >= 7.5.0 < 7.5.3 | 7.5.3 |
| microsoft | windows_10_1607 | < 10.0.14393.8422 | 10.0.14393.8422 |
| microsoft | windows_10_1809 | < 10.0.17763.7792 | 10.0.17763.7792 |
| microsoft | windows_10_21h2 | < 10.0.19044.6332 | 10.0.19044.6332 |
| microsoft | windows_10_22h2 | < 10.0.19045.6332 | 10.0.19045.6332 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.8422 | 10.0.14393.8422 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.7792 | 10.0.17763.7792 |
| microsoft | windows_10_version_21h2 | >= 10.0.19044.0 < 10.0.19044.6332 | 10.0.19044.6332 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.6332 | 10.0.19045.6332 |
| microsoft | windows_11_22h2 | < 10.0.22621.5909 | 10.0.22621.5909 |
| microsoft | windows_11_23h2 | < 10.0.22631.5909 | 10.0.22631.5909 |
| microsoft | windows_11_24h2 | < 10.0.26100.6508 | 10.0.26100.6508 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.5909 | 10.0.22621.5909 |
| microsoft | windows_11_version_22h3 | >= 10.0.22631.0 < 10.0.22631.5909 | 10.0.22631.5909 |
| microsoft | windows_11_version_23h2 | >= 10.0.22631.0 < 10.0.22631.5909 | 10.0.22631.5909 |
| microsoft | windows_11_version_24h2 | >= 10.0.26100.0 < 10.0.26100.6584 | 10.0.26100.6584 |
| microsoft | windows_server_2016 | < 10.0.14393.8422 | 10.0.14393.8422 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.8422 | 10.0.14393.8422 |
| microsoft | windows_server_2019 | < 10.0.17763.7792 | 10.0.17763.7792 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.7792 | 10.0.17763.7792 |
| microsoft | windows_server_2022 | < 10.0.20348.4106 | 10.0.20348.4106 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.4171 | 10.0.20348.4171 |
CVSS provenance
nvdv3.17.0HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_msrc7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
PowerShell Direct Elevation of Privilege Vulnerability
vendor_msrc·2025-09-09·CVSS 7.0
CVE-2025-49734 [HIGH] CWE-923 PowerShell Direct Elevation of Privilege Vulnerability
PowerShell Direct Elevation of Privilege Vulnerability
Description: Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.
FAQ: What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker, initially a non-admin user on the host, could hijack the PowerShell Direct session intended for communication between the admin user on host and a guest VM. This unauthorized access enables the attacker to impersonate the admin host user in communications with the guest, potentially manipulating or controlling guest-side operations.
FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exp
GHSA
GHSA-q77p-wfv8-75pp: Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally
ghsa_unreviewed·2025-09-09
CVE-2025-49734 [HIGH] CWE-923 GHSA-q77p-wfv8-75pp: Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally
Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.
No detection rules found.
No public exploits indexed.
2025-09-09
Published