CVE-2025-49734

CWE-9234 documents4 sources

Severity

7.0HIGH

EPSS

0.1%

top 82.57%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Powershell 7.4 Microsoft Powershell 7.5 Microsoft Windows 10 Version 1607 +23 more

Timeline

PublishedSep 9

Description

Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages26 packages

▶NVDmicrosoft/windows< 10.0.14393.8422+4

▶NVDmicrosoft/powershell7.4 — 7.4.12+1

▶CVEListV5microsoft/powershell_7.47.4.0 — 7.4.12

▶CVEListV5microsoft/powershell_7.57.5.0 — 7.5.3

▶NVDmicrosoft/windows_10_1607< 10.0.14393.8422

🔴Vulnerability Details

CVEList

PowerShell Direct Elevation of Privilege Vulnerability↗2025-09-09

▶

GHSA

GHSA-q77p-wfv8-75pp: Improper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally↗2025-09-09

▶

📋Vendor Advisories

Microsoft

PowerShell Direct Elevation of Privilege Vulnerability↗2025-09-09

▶