« Volver al listado

CVE-2026-59119

Estado: AnalizadaAlta (7.3)—

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L + UI:R indica ejecución en cliente (archivo preparado). CWE-276 (permisos incorrectos) + descripción de escalada sugiere T1548/T1548.002 como impactos. T1222 de la pista es lectura de archivos; aquí el texto indica elevación de privilegios local explícitamente.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Update SoftwarePrivileged Account ManagementAuditUser Account ControlUser Account ManagementRestrict File and Directory Permissions

Tecnologías afectadas (1)

Microsoft — Powershell

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-59119",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-59119",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-07T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "PowerShell 7.4",
          "versions": [
            {
              "status": "affected",
              "version": "7.4.0",
              "lessThan": "7.4.19.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "PowerShell 7.5",
          "versions": [
            {
              "status": "affected",
              "version": "7.5.0",
              "lessThan": "7.5.10.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "PowerShell 7.6",
          "versions": [
            {
              "status": "affected",
              "version": "7.6.0",
              "lessThan": "7.6.5",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-11T17:18:05.957",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-59119",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally."
    }
  ],
  "lastModified": "2026-08-17T11:31:25.347",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1CADAEE5-16D8-4289-AFBE-E4E7933CC033",
              "versionEndExcluding": "7.4.19.0",
              "versionStartIncluding": "7.4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF33CB93-513C-4C02-9D1B-9E5DB99ED95E",
              "versionEndExcluding": "7.5.10.0",
              "versionStartIncluding": "7.5"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powershell:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "587F471D-D4F5-4A2B-874E-44F571796FD8",
              "versionEndExcluding": "7.6.5",
              "versionStartIncluding": "7.6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}