CVE-2026-59119: Microsoft PowerShell Privilege Escalation

CVE-2026-59119 Overview

CVE-2026-59119 is a local privilege escalation vulnerability in Microsoft PowerShell. The flaw stems from incorrect default permissions [CWE-276] applied to PowerShell resources. An authorized local attacker can abuse these permissions to elevate privileges on an affected host.

Exploitation requires local access, low privileges, and user interaction, according to the CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Successful exploitation impacts confidentiality, integrity, and availability. Microsoft published the advisory on the MSRC portal.

Critical Impact
A local, authenticated attacker who convinces a user to perform a routine action can gain elevated privileges on the affected system, enabling code execution in a higher security context.

Affected Products

Microsoft PowerShell (see the Microsoft CVE-2026-59119 Advisory for the authoritative version list)

Discovery Timeline

2026-08-11 - CVE-2026-59119 published to the National Vulnerability Database
2026-08-12 - Last updated in the NVD database

Technical Details for CVE-2026-59119

Vulnerability Analysis

The issue is classified under [CWE-276] Incorrect Default Permissions. PowerShell ships with default access control settings on one or more resources that grant broader access than intended. A low-privileged, authenticated user on the local system can leverage this misconfiguration to reach objects that should be restricted to higher-privileged principals.

The attack scope is unchanged, meaning the elevated privileges apply within the security authority hosting the vulnerable component. The vulnerability affects confidentiality, integrity, and availability at a high level once exploitation succeeds. Microsoft characterizes the vector as local with low attack complexity, indicating that no specialized conditions are required beyond the presence of the misconfigured resource.

Root Cause

The root cause is an access control list applied to a PowerShell-owned resource, such as a file, directory, registry key, or executable path, that permits write or modify access to a group broader than administrators. A user in that broader group can replace or tamper with the resource before it is loaded or executed by a privileged process.

Attack Vector

Exploitation follows a classic permissions-abuse pattern. The attacker, already authenticated on the host, plants or modifies content in a location writable due to the weak default permissions. When a privileged user or scheduled process interacts with PowerShell, the attacker-controlled content is loaded in the higher-privilege context. User interaction is required, which typically means a privileged user must launch PowerShell, run a script, or trigger the affected component.

No public proof-of-concept code is available. Refer to the Microsoft CVE-2026-59119 Advisory for vendor-supplied technical details.

Detection Methods for CVE-2026-59119

Indicators of Compromise

Unexpected modifications to PowerShell installation directories, module paths, or profile scripts by non-administrative users.
Creation of new files in PSModulePath locations by standard user accounts followed by execution under a privileged session.
PowerShell processes spawning child processes running as SYSTEM or an administrative account shortly after a standard-user file write.

Detection Strategies

Audit file system access control lists on PowerShell binaries, module directories, and profile files, and alert on entries granting write access to non-privileged groups.
Enable PowerShell Script Block Logging and Module Logging, and correlate script loads with the identity that last wrote the script on disk.
Monitor Windows Security event IDs 4663 and 4670 for permission changes and writes to PowerShell paths.

Monitoring Recommendations

Baseline the expected owners, ACLs, and hashes of PowerShell modules across the fleet and alert on drift.
Track process ancestry where powershell.exe or pwsh.exe runs elevated after loading a module last modified by a standard user.
Forward PowerShell operational logs and Sysmon file-create events to a centralized analytics pipeline for cross-host correlation.

How to Mitigate CVE-2026-59119

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-59119 Advisory as soon as it is available for your PowerShell version.
Inventory hosts running PowerShell and prioritize multi-user systems, jump servers, and build agents where privileged users routinely execute scripts.
Restrict interactive local logon on sensitive systems to reduce the population of accounts able to stage an exploit.

Patch Information

Microsoft addresses CVE-2026-59119 through updates published on the Microsoft Security Response Center. Consult the Microsoft CVE-2026-59119 Advisory for the specific PowerShell versions, package identifiers, and installation guidance applicable to your environment.

Workarounds

Harden ACLs on PowerShell installation directories and PSModulePath entries so that only administrators and SYSTEM have write access.
Enforce PowerShell Constrained Language Mode and application control policies such as Windows Defender Application Control (WDAC) to limit unsigned script execution.
Remove any world-writable module paths and validate that user-scoped module directories are not referenced by privileged sessions.

bash

# Audit ACLs on PowerShell module paths (run in an elevated PowerShell session)
$paths = $env:PSModulePath -split ';'
foreach ($p in $paths) {
    if (Test-Path $p) {
        Write-Host "Path: $p"
        (Get-Acl $p).Access |
            Where-Object { $_.IdentityReference -notmatch 'Administrators|SYSTEM|TrustedInstaller' } |
            Format-Table IdentityReference, FileSystemRights, AccessControlType
    }
}