{"id":"CVE-2026-113815","kind":"vulnerability","aliases":["CVE-2026-113815"],"related":[],"title":"Windows PowerShell: code injection lets a local user bypass a security feature","description":"Improper control of generation of code ('code injection') in Windows PowerShell allows an authorized attacker to bypass a security feature locally.","summary":"Windows PowerShell has a code injection flaw that lets an authorized attacker bypass a security feature. The attacker must already be able to use the machine locally, per the NVD description.","severity":"medium","cvss":4.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows PowerShell","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","powershell","windows"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T19:19:00+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","triaged_at":"2026-11-10T20:04:11+00:00","updated_at":"2026-11-10T20:04:11+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T20:04:11Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows PowerShell: code injection lets a local user bypass a security feature","impact":"medium","summary":"Windows PowerShell has a code injection flaw that lets an authorized attacker bypass a security feature. The attacker must already be able to use the machine locally, per the NVD description.","audience":"businesses","category":"other","nicknames":[],"who_cares":["windows","powershell"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local attacker bypasses a security feature on the machine","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"Windows PowerShell","needs_analyst":false,"not_affected_if":[],"who_is_affected":"Windows machines running Windows PowerShell where a user already has local access. The sources do not say which PowerShell versions or which security feature is bypassed.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000634,"input_tokens":4495,"output_tokens":369,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113815':15A,18A '-2026':14A,17A 'abl':45B 'allow':66C 'alreadi':43B 'attack':35B,41B,69C 'author':34B,68C 'bypass':9A,36B,71C 'code':3A,28B,60C,61C 'control':56C 'cve':13A,16A 'descript':54B 'featur':12A,39B,74C 'flaw':30B 'generat':58C 'improp':55C 'inject':4A,29B,62C 'let':5A,32B 'local':7A,50B,75C 'machin':49B 'must':42B 'nvd':53B 'per':51B 'powershel':2A,22B,25B,65C 'powershell':20A 'secur':11A,38B,73C 'use':47B 'user':8A 'window':1A,23B,24B,64C 'windows':19A","nicknames":[],"mitigations":[],"who_affected":"Windows machines running Windows PowerShell where a user already has local access. The sources do not say which PowerShell versions or which security feature is bypassed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["powershell","windowspowershell"],"ptokens":["powershell","windows"],"labels":["medium","other","powershell","vendor","windows"],"campaign_type":null,"search_a":"'-113815':15A,18A '-2026':14A,17A 'bypass':9A 'code':3A 'cve':13A,16A 'featur':12A 'inject':4A 'let':5A 'local':7A 'powershel':2A 'powershell':20A 'secur':11A 'user':8A 'window':1A 'windows':19A","search_b":"'abl':45B 'alreadi':43B 'attack':35B,41B 'author':34B 'bypass':36B 'code':28B 'descript':54B 'featur':39B 'flaw':30B 'inject':29B 'let':32B 'local':50B 'machin':49B 'must':42B 'nvd':53B 'per':51B 'powershel':22B,25B 'secur':38B 'use':47B 'window':23B,24B","search_c":"'allow':66C 'attack':69C 'author':68C 'bypass':71C 'code':60C,61C 'control':56C 'featur':74C 'generat':58C 'improp':55C 'inject':62C 'local':75C 'powershel':65C 'secur':73C 'window':64C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:00+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113815","severity":null,"published_at":"2026-11-10T19:19:00+00:00","modified_at":"2026-11-10T19:19:00+00:00","first_seen_at":"2026-11-10T19:24:41+00:00","fetched_at":"2026-11-10T19:24:41+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}