CVE-2022-26788
📋 TL;DR
This PowerShell vulnerability allows authenticated attackers to execute arbitrary code with elevated privileges on affected Windows systems. It affects systems running PowerShell 7.2 and 7.3 where an attacker can exploit a flaw in how PowerShell handles certain operations. This primarily impacts Windows environments where PowerShell is used for administration.
💻 Affected Systems
- PowerShell 7
- PowerShell Core
📦 What is this software?
Powershell by Microsoft
Powershell by Microsoft
Powershell by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 11 by Microsoft
Windows 11 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker gains SYSTEM-level privileges, enabling complete system compromise, data theft, lateral movement, and persistence establishment.
Likely Case
Authenticated users (including low-privilege accounts) escalate to administrator privileges, allowing them to install malware, modify system configurations, or access sensitive data.
If Mitigated
With proper access controls and monitoring, exploitation would be detected and contained before significant damage occurs.
🎯 Exploit Status
Exploitation requires authenticated access to the system. Proof-of-concept code has been published, making weaponization likely.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: PowerShell 7.2.8 or later, PowerShell 7.3.2 or later
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26788
Restart Required: No
Instructions:
1. Download latest PowerShell 7.x from Microsoft's GitHub releases. 2. Install the update on affected systems. 3. Verify PowerShell version with 'pwsh --version'.
🔧 Temporary Workarounds
Restrict PowerShell Access
windowsLimit which users can execute PowerShell scripts through Group Policy or application control policies.
# Use Group Policy: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on Script Execution > Set to 'Allow only signed scripts' or 'Disabled'
Implement Least Privilege
windowsEnsure users only have necessary permissions and cannot run PowerShell with elevated privileges.
# Use Group Policy: Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment > Remove users from 'Debug programs' and 'Create a token object' privileges
🧯 If You Can't Patch
- Implement strict access controls to limit who can execute PowerShell on affected systems
- Deploy application whitelisting to prevent unauthorized PowerShell execution
🔍 How to Verify
Check if Vulnerable:
Run 'pwsh --version' and check if version is between 7.2.0-7.2.7 or 7.3.0-7.3.1Check Version:
pwsh --versionVerify Fix Applied:
Run 'pwsh --version' and confirm version is 7.2.8+ or 7.3.2+📡 Detection & Monitoring
Log Indicators:
- Event ID 4104 in Windows PowerShell logs showing suspicious script execution
- Unexpected PowerShell processes running with elevated privileges
- PowerShell execution from unusual user accounts
Network Indicators:
- PowerShell remoting (WinRM) connections to multiple systems in short time
- Unusual outbound connections following PowerShell execution
SIEM Query:
source="Windows PowerShell" EventCode=4104 | stats count by host, user