CVE-2026-59119: PowerShell Elevation of Privilege Vulnerability
CVE-2026-59119 is an elevation of privilege vulnerability in PowerShell, rated Important by Microsoft, with a CVSS 3.1 base score of 7.3 (High). An attacker can exploit it by an attacker with local access, with low privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.38% probability of exploitation activity in the next 30 days, higher than 32% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday. It affects 3 products in 1 product family (Developer Tools).
Key facts
- CVE ID
- CVE-2026-59119
- Severity
- High CVSS 7.3
- Microsoft severity
- Important
- Impact
- Elevation of Privilege
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-276
- EPSS
- 0.38% (percentile 32%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2026 Patch Tuesday
- Product families
- Developer Tools
CVSS score and vector
Microsoft scores CVE-2026-59119 at 7.3 (temporal 6.4) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
Frequently asked questions (Microsoft)
What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.
According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability?
An authorized attacker with privileges could send controlled inputs to exploit this vulnerability.
Affected products (3)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| PowerShell 7.5 | Security update | Security Update | 7.5.10.0 | Maybe |
| PowerShell 7.4 | Security update | Security Update | 7.4.19.0 | Maybe |
| PowerShell 7.6 | Security update | Security Update | 7.6.5 | Maybe |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 7.3 (HIGH)
- NVD weakness
- CWE-276
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| powershell | from 7.4, before 7.4.19.0 |
| powershell | from 7.5, before 7.5.10.0 |
| powershell | from 7.6, before 7.6.5 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59119 (Vendor Advisory)
Acknowledgments
- Trung Nguyen with CyStack
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 2.0 | The security updates for Powershell have been updated. |