First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-121669

MediumCVSS 6.1/10Last modified Nov 11, 2026

Description

Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Microsoft	PowerShell 7.6	>= 7.6.0, < 7.6.10
Microsoft	PowerShell 7.7	>= 1.0.0, < 7.7.0

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-121669

Timeline

Published: Nov 10, 2026
Last modified: Nov 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-121677.8The Minifilter communication port for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to access privileged driver fun CVE-2026-1216707.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized a CVE-2026-1216717.0Use after free in Windows Audio Service allows an authorized attacker to elevate privileges locally.CVE-2026-1216737.8Use after free in Windows Filter Manager allows an authorized attacker to elevate privileges locally.CVE-2026-1216746.1Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over CVE-2026-1216756.1Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a CVE-2026-1216776.5Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-1216785.3Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-121687.8An improper validation vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to escalate privileges to SY CVE-2026-1216807.5Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a networ CVE-2026-1216817.8Heap-based buffer overflow in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.CVE-2026-1216839.4Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated attacker to add and delete arbitra

CVE-2026-121669: Medium severity, CVSS 6.1 | Vulnix