CVE-2026-58612 Overview
CVE-2026-58612 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft PowerShell Core. An unauthorized attacker can leverage the flaw to disclose information over a network. The weakness is tracked under CWE-918 and requires user interaction to succeed. Exploitation crosses a security scope boundary, giving attackers access to resources that should remain isolated from the network-facing PowerShell process.
Critical Impact
Successful exploitation lets an unauthenticated attacker coerce PowerShell Core into issuing attacker-controlled requests, disclosing sensitive information from systems reachable by the affected host.
Affected Products
- Microsoft PowerShell Core (see the Microsoft CVE-2026-58612 Update Guide for exact versions)
Discovery Timeline
- 2026-08-11 - CVE-2026-58612 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-58612
Vulnerability Analysis
The vulnerability is a Server-Side Request Forgery condition in Microsoft PowerShell Core. PowerShell Core accepts a URL or resource reference and issues a request on behalf of the caller without sufficient validation of the destination. An attacker who convinces a user to run a crafted script or command triggers outbound requests from the PowerShell process to attacker-selected endpoints. Because the request originates from the trusted host, it can reach internal services, cloud metadata endpoints, or other resources normally shielded from external networks.
The scope-change property of this issue means the impact is not limited to the PowerShell process itself. Responses to the forged request can carry sensitive information back to the attacker, resulting in information disclosure across a trust boundary. Confidentiality impact is high, while integrity and availability are unaffected.
Root Cause
The root cause is insufficient validation of URLs or network destinations passed to PowerShell Core request-issuing functionality, matching the CWE-918 pattern. The runtime does not restrict targets to intended hosts, allowing redirection to internal-only resources.
Attack Vector
The attack vector is network-based and requires user interaction. An attacker delivers a crafted script, module, or command that triggers a PowerShell Core request to an attacker-chosen URL. Refer to the Microsoft CVE-2026-58612 Update Guide for authoritative exploitation details.
No public proof-of-concept is available at the time of publication.
Detection Methods for CVE-2026-58612
Indicators of Compromise
- Outbound HTTP or HTTPS requests originating from pwsh or powershell processes to unexpected internal addresses, including cloud metadata endpoints such as 169.254.169.254.
- PowerShell script blocks that invoke Invoke-WebRequest, Invoke-RestMethod, or related cmdlets with dynamically constructed URLs from untrusted input.
- Unexpected DNS lookups from PowerShell hosts targeting internal service names.
Detection Strategies
- Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging to capture URL arguments passed to request cmdlets.
- Correlate PowerShell process telemetry with outbound network connections to internal RFC1918 ranges or cloud metadata IPs.
- Hunt for user-triggered PowerShell sessions that generate anomalous outbound web traffic shortly after script execution.
Monitoring Recommendations
- Alert on PowerShell processes contacting cloud instance metadata services from workloads that do not normally require metadata calls.
- Baseline typical outbound destinations for administrative PowerShell hosts and flag deviations.
- Retain PowerShell transcription logs centrally for forensic review of URL parameters.
How to Mitigate CVE-2026-58612
Immediate Actions Required
- Apply the Microsoft-provided update for PowerShell Core as documented in the Microsoft CVE-2026-58612 Update Guide.
- Inventory hosts running PowerShell Core, including Linux and macOS systems where pwsh is installed.
- Restrict execution of untrusted PowerShell scripts and modules until patching is complete.
Patch Information
Microsoft publishes fixed builds through the Microsoft CVE-2026-58612 Update Guide. Update PowerShell Core to the version listed there on all managed endpoints and servers.
Workarounds
- Enforce PowerShell Constrained Language Mode where feasible to limit the cmdlets and parameters available to untrusted scripts.
- Egress-filter PowerShell hosts so they cannot reach cloud metadata endpoints or sensitive internal services directly.
- Require signed scripts via Set-ExecutionPolicy AllSigned and block untrusted modules through Windows Defender Application Control policies.
# Configuration example: verify PowerShell Core version and apply update on Linux
pwsh -Command '$PSVersionTable.PSVersion'
# On Debian/Ubuntu, refresh the Microsoft package repository and upgrade
sudo apt-get update
sudo apt-get install --only-upgrade powershell
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
