CVE-2026-58612: PowerShell Information Disclosure Vulnerability
CVE-2026-58612 is an information disclosure vulnerability in PowerShell, rated Important by Microsoft, with a CVSS 3.1 base score of 7.4 (High). An attacker can exploit it remotely over the network, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.87% probability of exploitation activity in the next 30 days, higher than 59% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday. It affects 3 products in 1 product family (Developer Tools).
Key facts
- CVE ID
- CVE-2026-58612
- Severity
- High CVSS 7.4
- Microsoft severity
- Important
- Impact
- Information Disclosure
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-918
- EPSS
- 0.87% (percentile 59%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2026 Patch Tuesday
- Product families
- Developer Tools
CVSS score and vector
Microsoft scores CVE-2026-58612 at 7.4 (temporal 6.4) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Changed |
| Confidentiality impact | High |
| Integrity impact | None |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.
Frequently asked questions (Microsoft)
What type of information could be disclosed by this vulnerability?
Exploiting this vulnerability could allow the disclosure of credentials.
Affected products (3)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| PowerShell 7.5 | Security update | Security Update | 7.5.10.0 | Maybe |
| PowerShell 7.4 | Security update | Security Update | 7.4.19.0 | Maybe |
| PowerShell 7.6 | Security update | Security Update | 7.6.5 | Maybe |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 7.4 (HIGH)
- NVD weakness
- CWE-918
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| powershell | from 7.4, before 7.4.19.0 |
| powershell | from 7.5, before 7.5.10.0 |
| powershell | from 7.6, before 7.6.5 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58612 (Vendor Advisory)
Acknowledgments
- AL Najafi
- Amar Khatri
- Anonymous
- Ayato
- Charlie Vogt
- Damian Regulski
- HASAN FLAYYIH ABDULLAH
- Joseph Semaan
- Krithik Babu P (DarkLycn1976)
- Lucas Futures
- Michael Curtis
- Mohit_Negi with Bugcrowd
- murloc
- NavSec
- Peng Zhou (zpbrent)
- PuH4ck3rX
- PuH4ck3rX with W&M
- Theodor N. Engøy
- Vadim Drobinin (@valzevul) with Drobinin Limited
- Yogi Atram
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 2.0 | The security updates for Powershell have been updated. | |
| 2.1 | Acknowledgement Updated | |
| 2.2 | Updated an acknowledgement. This is an informational change only. |