CVE-2026-124224

HighCVSS 7.0/10Last modified Nov 11, 2026

Description

Improper link resolution before file access ('link following') in Windows PowerShell allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-59

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 11, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1242257.8Improper control of generation of code ('code injection') in Windows PowerShell allows an unauthorized attacker to execute code locally.CVE-2026-1242268.8Execution with unnecessary privileges in Windows PowerShell allows an authorized attacker to bypass a security feature locally.CVE-2026-1242277.5Use of uninitialized resource in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.CVE-2026-1242288.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office Outlook allows an authorized attacker to CVE-2026-1242296.6Deserialization of untrusted data in Microsoft Office Excel allows an unauthorized attacker to execute code with a physical attack.CVE-2026-124237.5A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semCVE-2026-1242336.5Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.CVE-2026-124247.2The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to, and including, 7.2.4CVE-2026-1242496.3http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and PCVE-2026-124256.1Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access CenCVE-2026-1242507.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd GeoDirectory geodirectory CVE-2026-1242518.8Cross-Site Request Forgery (CSRF) vulnerability in XplodedThemes WPIDE – File Manager & Code Editor wpide allows Cross Site Request Forgery.
CVE-2026-124224: High severity, CVSS 7.0 | Vulnix