CVE-2025-54100High· 7.8▾ MidnightPoC availableImproper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 42.9 · likelihood 0.4 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
2.2%
Last analysed / modified upstream
3 GitHub repos (last check)
Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.
windows_10_1607 < 10.0.14393.8688windows_10_1809 < 10.0.17763.8146windows_10_21h2 < 10.0.19044.6691windows_10_22h2 < 10.0.19045.6691windows_11_23h2 < 10.0.22631.6345windows_11_24h2 < 10.0.26100.7456windows_11_25h2 < 10.0.26200.7456windows_server_2008windows_server_2008 = r2windows_server_2012windows_server_2012 = r2windows_server_2016 < 10.0.14393.8688windows_server_2019 < 10.0.17763.8146windows_server_2022 < 10.0.20348.4529windows_server_2022_23h2 < 10.0.25398.2025windows_server_2025 < 10.0.26100.7456Upgrade past the affected range:
windows_10_1607 10.0.14393.8688windows_10_1809 10.0.17763.8146windows_10_21h2 10.0.19044.6691windows_10_22h2 10.0.19045.6691windows_11_23h2 10.0.22631.6345windows_11_24h2 10.0.26100.7456windows_11_25h2 10.0.26200.7456windows_server_2016 10.0.14393.8688windows_server_2019 10.0.17763.8146windows_server_2022 10.0.20348.4529windows_server_2022_23h2 10.0.25398.2025windows_server_2025 10.0.26100.7456Connected by shared product, vendor, weakness, or advisory.
CVE-2025-62470High· 7.8Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVE-2018-8174High· 7.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1…
CVE-2026-20820High· 7.8Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-20805Medium· 5.5Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
CVE-2026-24294High· 7.8Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
CVE-2026-105014Critical· 9.1Azure Pipelines Remote Code Execution Vulnerability