Microsoft Patches PowerShell Credential Disclosure Vulnerability

Microsoft released an official fix for CVE-2026-121674, an information disclosure vulnerability in PowerShell Core that could expose credentials to an unauthorized attacker over a network. Microsoft rates the flaw Important, with a CVSS v3.1 base score of 6.1. Successful exploitation requires user interaction and specific protocol settings or configurations, resulting in high attack complexity. At its November 10 disclosure, Microsoft reported no known exploitation or prior public disclosure and assessed exploitation as less likely.

The associated weakness, CWE-201: Insertion of Sensitive Information Into Sent Data, describes software improperly including sensitive information in data transmitted to another party. Organizations should apply Microsoft's fix to affected PowerShell Core installations and review relevant protocol configurations to assess exposure. Broader safeguards against this weakness include minimizing sensitive data in outbound content, using safe default error messages, and enforcing compartmentalization and least privilege.