Two vulnerabilities have been identified by Microsoft within PowerShell version 7 and 7.1. The first flaw, tracked as CVE-2020-0951 is a bypass vulnerability that disables Windows Defender Application Control (WDAC) enforcements, which could allow an attacker to execute PowerShell commands that would otherwise be blocked and thus unable to execute. The second flaw, tracked as CVE-2021-41355, is an information disclosure vulnerability. Microsoft stated that the “…vulnerability exists in .NET where System.DirectoryServices.Protocols.LdapConnection may send credentials in plain text on non-Windows Operating systems.” The exploitation of this vulnerability could give an attacker access to administrative credentials, allowing them to change configurations, passwords, and many other actions that an attacker could use to take complete control of a target system. According to Microsoft, there is currently no patch to block these exploits, and system administrators are urged to upgrade to PowerShell versions 7.0.8 and 7.1.5. Details on which PowerShell versions are affected can be found in the links below.