{"id":"CVE-2026-124225","kind":"vulnerability","aliases":["CVE-2026-124225"],"related":[],"title":"Windows PowerShell: Invoke-WebRequest to a malicious URL can run script in your session","description":"Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.","summary":"Microsoft (MSRC, Nov 10 2026) rates this Important, CVSS 7.8, CWE-94. An attacker-controlled URL returns a crafted non-2xx HTML response; Windows PowerShell parses it through MSHTML without the security confirmation prompt, and embedded script can run in the invoking PowerShell process. A victim, or an automated process they control, must call Invoke-WebRequest against that URL. Microsoft says not publicly disclosed, not exploited, Exploitation Less Likely; official fix available.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","invoke-webrequest","powershell","user-interaction","windows"],"not_affected_if":["no-invoke-webrequest-untrusted-urls"],"how_to_check":"Find scripts and scheduled tasks that run Invoke-WebRequest (iwr, curl alias in Windows PowerShell 5.1) against URLs you do not control. Look up CVE-2026-124225 in the MSRC Security Update Guide for your Windows version's KB, then confirm it is installed with Get-HotFix -Id KB<number>. The affected builds and KB numbers could not be read from the page text we fetched.","fix":"Microsoft lists an official fix, delivered through the Nov 2026 Windows security updates; exact KB per Windows version is not confirmed here. Install the November 2026 cumulative update.","status":"open","published_at":"2026-11-10T19:20:48+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","triaged_at":"2026-11-10T19:38:52+00:00","updated_at":"2026-11-10T21:27:39+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-10T19:38:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows PowerShell: code injection lets a local attacker run code","impact":"high","summary":"Windows PowerShell does not properly control how it generates code, so an unauthorized attacker can inject and execute code. The attacker needs to be on the machine, per the NVD description.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","powershell"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code locally on the Windows machine","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-124225 to confirm affected builds, the fixed update, and whether authentication is required.","how_to_check":"- Check the installed PowerShell version with `$PSVersionTable.PSVersion` and compare it with the fixed builds in the Microsoft advisory, which the sources do not list.\n- Confirm Windows is patched with Windows Update, since the sources do not name a specific build.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The NVD description names Windows PowerShell and a local attacker, and gives no affected version ranges or configuration details. Teams running Windows hosts with PowerShell should check their patch level against the vendor advisory. unknown whether any non-default setting is required.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00071,"input_tokens":4494,"output_tokens":522,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft Security Response Center advisory for CVE-2026-124225 to confirm affected builds, the fixed update, and whether authentication is required.","search":"'-124225':18A,21A '-2026':17A,20A '-94':42B '10':34B '2026':35B '2xx':53B '7.8':40B 'allow':117C 'attack':45B,120C 'attacker-control':44B 'autom':81B 'avail':105B 'call':86B 'code':111C,112C,123C 'confirm':65B 'control':46B,84B,107C 'craft':50B 'cve':16A,19A 'cvss':39B 'cwe':41B 'disclos':97B 'embed':68B 'execut':122C 'exploit':99B,100B 'fix':104B 'generat':109C 'html':54B 'import':38B 'improp':106C 'infrastructur':22B 'inject':113C 'interact':29B 'invok':4A,24B,74B,88B 'invoke-webrequest':3A,23B,87B 'less':101B 'like':102B 'local':124C 'malici':8A 'microsoft':31B,93B 'mshtml':61B 'msrc':32B 'must':85B 'non':52B 'non-2xx':51B 'nov':33B 'offici':103B 'pars':58B 'powershel':2A,26B,57B,75B,116C 'process':76B,82B 'prompt':66B 'public':96B 'rate':36B 'respons':55B 'return':48B 'run':11A,71B 'say':94B 'script':12A,69B 'secur':64B 'session':15A 'unauthor':119C 'url':9A,47B,92B 'user':28B 'user-interact':27B 'victim':78B 'webrequest':5A,25B,89B 'window':1A,30B,56B,115C 'without':62B","nicknames":[],"mitigations":[],"who_affected":"Windows PowerShell (Windows PowerShell, not PowerShell 7 as far as the advisory says) on Windows hosts where a user or script runs Invoke-WebRequest against URLs an attacker can control. Scripts and automation that fetch untrusted URLs deserve a look first. Machines that never call Invoke-WebRequest against untrusted URLs have little exposure. The MSRC page text we could read lists no builds or KBs.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","invokewebrequest","powershell","userinteraction","windows"],"campaign_type":null,"search_a":"'-124225':18A,21A '-2026':17A,20A 'cve':16A,19A 'invok':4A 'invoke-webrequest':3A 'malici':8A 'powershel':2A 'run':11A 'script':12A 'session':15A 'url':9A 'webrequest':5A 'window':1A","search_b":"'-94':42B '10':34B '2026':35B '2xx':53B '7.8':40B 'attack':45B 'attacker-control':44B 'autom':81B 'avail':105B 'call':86B 'confirm':65B 'control':46B,84B 'craft':50B 'cvss':39B 'cwe':41B 'disclos':97B 'embed':68B 'exploit':99B,100B 'fix':104B 'html':54B 'import':38B 'infrastructur':22B 'interact':29B 'invok':24B,74B,88B 'invoke-webrequest':23B,87B 'less':101B 'like':102B 'microsoft':31B,93B 'mshtml':61B 'msrc':32B 'must':85B 'non':52B 'non-2xx':51B 'nov':33B 'offici':103B 'pars':58B 'powershel':26B,57B,75B 'process':76B,82B 'prompt':66B 'public':96B 'rate':36B 'respons':55B 'return':48B 'run':71B 'say':94B 'script':69B 'secur':64B 'url':47B,92B 'user':28B 'user-interact':27B 'victim':78B 'webrequest':25B,89B 'window':30B,56B 'without':62B","search_c":"'allow':117C 'attack':120C 'code':111C,112C,123C 'control':107C 'execut':122C 'generat':109C 'improp':106C 'inject':113C 'local':124C 'powershel':116C 'unauthor':119C 'window':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:20:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124225","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124225","severity":null,"published_at":"2026-11-10T19:20:48+00:00","modified_at":"2026-11-10T19:20:49+00:00","first_seen_at":"2026-11-10T19:25:13+00:00","fetched_at":"2026-11-10T19:25:13+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124225:2795","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124225","severity":null,"published_at":"2026-11-10T21:27:39+00:00","modified_at":"2026-11-10T21:27:39+00:00","first_seen_at":"2026-11-10T21:27:39+00:00","fetched_at":"2026-11-10T21:27:39+00:00","note":"Read MSRC page: mechanism, rating, exploitability confirmed; affected builds/KBs not in the fetched text (JS table), so no product rows, nothing verified. X/search not used.","cites":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124225"]}],"documents":[{"id":118861,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-124225","title":"MSRC: CVE-2026-124225 Windows PowerShell Remote Code Execution Vulnerability","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}