TI-2019-00892 Aliases CVE-2019-1167 GHSA-5frh-8cmj-gc59

A security feature bypass vulnerability exists in Windows Defender Application Control…

LOW 21Published 2019-07-19 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub.

Summary

A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'.

Why it matters now

EPSS 0.011 65th percentileScored 2026-11-07

Fix Fixed System.Management.Automation (NuGet): 6.2.2, 6.1.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	PowerShell Core	6.1; 6.2	—	No fix listed	CNA
—	System.Management.Automation (NuGet)	6.2.0 to before 6.2.2	6.2.2	Patch available	GHSA-5frh-8cmj-gc59
—	System.Management.Automation (NuGet)	6.1.0 to before 6.1.5	6.1.5	Patch available	GHSA-5frh-8cmj-gc59

PowerShell Core VendorMicrosoft Affected 6.1; 6.2 Fixed in — No fix listed CNA
System.Management.Automation (NuGet) Vendor— Affected 6.2.0 to before 6.2.2 Fixed in 6.2.2 Patch available GHSA-5frh-8cmj-gc59
System.Management.Automation (NuGet) Vendor— Affected 6.1.0 to before 6.1.5 Fixed in 6.1.5 Patch available GHSA-5frh-8cmj-gc59

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:powershell_core:6.1:::::::*	6.1	Vulnerable	Microsoft
cpe:2.3:a:microsoft:powershell_core:6.2:::::::*	6.2	Vulnerable	Microsoft

cpe:2.3:a:microsoft:powershell_core:6.1:*:*:*:*:*:*:* Versions 6.1 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:powershell_core:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Microsoft

Remediation

Fix · GHSA-5frh-8cmj-gc59 System.Management.Automation (NuGet) Fixed in 6.2.2 Advisory →
Fix · GHSA-5frh-8cmj-gc59 System.Management.Automation (NuGet) Fixed in 6.1.5 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-1167
2026-10-03 Alias added: GHSA-5frh-8cmj-gc59

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1167

Advisory 2

Other 1

https://github.com/PowerShell/PowerShell/security/advisories/GHSA-5frh-8cmj-gc59

TI-2021-08380 .NET Core Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
TI-2018-05971 A remote code execution vulnerability exists when PowerShell improperly handles specially… CVSS 3.0HIGH 8.8
TI-2018-05996 Information disclosure in Microsoft PowerShell Core CVSS 3.0HIGH 7.5
TI-2021-08240 .NET Core and Visual Studio Denial of Service Vulnerability CVSS 3.1HIGH 7.5
TI-2018-00813 .NET Core 1.0, .NET Core 1.1, NET Core 2.0 and PowerShell Core 6.0.0 allow a denial of… CVSS 3.0HIGH 7.5
TI-2018-00708 Microsoft .NET Framework 1.1, 2.0, 3.0, 3.5, 3.5.1, 4, 4.5, 4.5.1, 4.5.2, 4.6, 4.6.1… CVSS 3.0HIGH 7.5

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences