CVE ID pending. Also tracked as “Verb-Nounageddon.”
Power2Shell
A critical design flaw in Windows PowerShell allows any user who opens it to run commands. Those commands then do what they say. Approved verbs included.
This is a working proof of concept. Click inside and type Get-Help.
PS> Get-Power2Shell | Format-ListSeverity at a glance
- CVSSScore
- 10.0430975462097436 (out of 10, Copilot couldn't decide)
- AttackComplexity
- Win + X, then one click
- ExposureWindow
- Since November 2006
- AttackVerbs
- 100+ (run Get-Verb to see them all)
- Pipeline
- Yes. Attacks can be chained with |
- PatchAvailable
- $false
How this research started
The disclosures of Terminal2Shell and sudo2shell left the security community with an uncomfortable question: if Unix-like systems were this exposed, what was hiding in Windows?
Windows is famous for keeping old programs around forever in the name of backwards compatibility. Somewhere in that pile, we reasoned, there had to be a forgotten tool that hands out shells. Our early findings were inconclusive.
- Windows Fax and Scan was still installed, ready for the fax machine we don’t have. It was not vulnerable, mostly because nobody has ever opened it.
- A crash dialog told us Windows was checking for a solution to the problem. It is still checking.
- We tried to audit the Start menu, but it was removed, brought back, centered and filled with recommended apps while we worked. By the time we finished our report, the Start menu had been redesigned again.
- Clippy was retired from Office in 2007. Our team keeps getting reports that he is still in there somewhere, offering to help. We are still looking into it.
Then we pressed Win + X. What we found was not old, and it was not hidden. It was in the menu, it had a blue window, and it accepted commands from anyone who typed them. We were shocked.
What is Power2Shell?
Power2Shell is a design-level vulnerability in Windows PowerShell and its cross-platform successor, PowerShell 7. When powershell.exe launches, it presents a prompt and waits. Whatever the user types next is parsed and executed with the full privileges of the logged-in account.
Researchers confirmed that PowerShell commands follow a predictable Verb-Noun naming scheme, which makes them trivially easy to guess. Remove-Item was observed removing items. Stop-Process stopped processes. Stop-Computer stopped the computer, which researchers describe as “a significant availability impact.”
Unlike traditional shells, PowerShell passes rich .NET objects between commands. This means an attacker who gets the output of one attack can pipe it directly into another attack, and the second attack will understand the first one perfectly. Microsoft calls this feature “the pipeline.” Researchers call it lateral movement within a single line.
Most alarming, PowerShell ships with aliases such as ls, cat and rm, allowing Windows attackers to disguise themselves as Linux users.
Exploitation steps
- Press Win + X.
- Click “Terminal.”
On systems with hardened menus, attackers have been seen using an advanced alternate vector: pressing Win + R and typing powershell. A third technique, typing “powershell” into the Start menu, has also been reported, although Start menu search results were inconsistent and sometimes opened Bing.
PS> Get-AffectedProduct | Format-TableAffected systems
| Product | Vector | Status |
|---|---|---|
| Windows 7 through 11 | powershell.exe, Win + X | Vulnerable |
| Windows Server 2008 R2 to 2025 | Remoting on by default since 2012 | Vulnerable |
| Windows Terminal | Opens PowerShell by default | Vulnerable |
| Windows PowerShell ISE | Deprecated, yet somehow still here | Vulnerable |
| PowerShell 7 (Linux, macOS) | Microsoft ported it on purpose | Vulnerable |
| Azure Cloud Shell | Microsoft hosts the exploit for you | Vulnerable |
| VS Code | Ctrl + ` | Vulnerable |
| Microsoft Excel | Under investigation (it has formulas) | Probably |
| Solitaire | None known | Not affected |
PS> Find-Power2Shell -Scope WorkplaceIndicators of compromise
Power2Shell leaves no malware behind, so detection depends on behavior. Our threat hunting team observed the following signals across compromised offices. Any two together should be treated as a confirmed breach.
| WhereToLook | Signal | Confidence |
|---|---|---|
| Browser history | Searches for “powershell equivalent of grep” | Certain |
| Monitor bezel | Sticky note reading Set-ExecutionPolicy Bypass | High |
| Desktop | Untitled1.ps1 through Untitled14.ps1 | High |
| Window title | “Administrator:” in front of the name. The attacker clicked Yes. | Certain |
| PSReadLine folder | ConsoleHost_history.txt, a record of every command ever typed. The attacker doesn’t know it exists. | Certain |
| Scripts | | Out-Null at the end of every line | Medium |
| Teams chat | A coworker saying “just run this one-liner” | Unfortunately high |
| The user’s mood | A backtick line break that failed because of one trailing space | Certain |
Event log evidence
Windows records Power2Shell activity in great detail, in a place no one looks. Below is a real-format event recovered from a compromised host.
PS> Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational -MaxEvents 1 | Format-List
- LogName
- Microsoft-Windows-PowerShell/Operational
- Id
- 4104
- TaskCategory
- Execute a Remote Command
- Message
- Creating Scriptblock text (1 of 1): Get-ChildItem
- RunLocation
- Local. The log is exaggerating.
- TimesRead
- 0
That task category is real. Windows files ordinary script blocks under “Execute a Remote Command” even when they ran on the same machine, which researchers believe means the logs are also panicking.
| EventId | Log | WhatItMeans |
|---|---|---|
| 400 | Windows PowerShell | The engine started. The exploit has opened. |
| 4104 | PowerShell/Operational | Script block logging. Records every attack in full, if someone turned it on. Nobody turned it on. |
| 4103 | PowerShell/Operational | Module logging. Records the same attack again, in more detail, for the one analyst who will read it. |
| 4688 | Security | Process creation. Requires an audit policy. See 4104. |
| 10016 | System | DistributedCOM. Unrelated to Power2Shell. Appears thousands of times a day anyway. Microsoft says to ignore it, so analysts learned to ignore everything. |
| 1102 | Security | The audit log was cleared. The last thing the log remembers is being forgotten. |
Even with logging off, PowerShell will quietly log a script block on its own if it looks suspicious. Stop-Computer was not considered suspicious. Researchers strongly disagree.
Our analysts rank the most reliable event log indicator as this: nobody has opened Event Viewer since 2019. The second most reliable is that someone just did, saw 40,000 red errors on a perfectly healthy machine, and closed it again.
Rumored mitigations
No vendor patch is available. Since disclosure, several workarounds have spread across forums, LinkedIn posts and a very confident Reddit thread. We tested each one. None of them work.
Rumor: set -ExecutionPolicy Restricted
Our research: it blocks scripts, not typing. Every cmdlet on this page still ran when typed by hand. Microsoft’s own documentation says the execution policy is not a security boundary, and it can be skipped with the sophisticated flag -ExecutionPolicy Bypass.
Rumor: use cmd.exe instead
Our research: from cmd.exe, typing powershell and pressing Enter opens PowerShell. The mitigation contains the exploit.
Rumor: Constrained Language Mode fixes it
Our research: Remove-Item, Stop-Process and Stop-Computer all kept working. The only thing it stopped was the finance team’s macro.
Rumor: type in all lowercase
Our research: PowerShell is case-insensitive, so remove-item and REMOVE-ITEM both work. Typing in all caps didn’t help either, though it did make the commands feel angrier.
Rumor: just uninstall PowerShell
Our research: Windows PowerShell is a built-in component and can’t be removed. PowerShell 7 can be, but anyone can reinstall it with winget, which is usually run from PowerShell. Researchers who did manage to remove it reported that the next Windows Update quietly put it back, along with their feelings about it.
Rumor: close the blue window
Our research: Win + X still works. The window comes back. It always comes back.
Timeline
- 2002 Jeffrey Snover publishes the Monad Manifesto. The vulnerability is documented in writing, years before it ships.
- 2006 Windows PowerShell 1.0 released. Verb-Noun attack surface goes live.
- 2009 PowerShell 2.0 ships inside Windows 7. Exploit now preinstalled.
- 2012 Windows Server 2012 turns on PowerShell Remoting by default. Shells can now be obtained on other computers, if you have the password.
- 2016 PowerShell is open-sourced and ported to Linux and macOS. The flaw achieves cross-platform reach.
- 2017 Windows 10 replaces Command Prompt with PowerShell in the Win + X menu. Attack complexity drops further.
- 2026 Researchers notify Microsoft. Microsoft replies: “Have you tried
Get-Help?”
FAQ
PS C:\Users\victim> Get-Answer "Am I affected?"
If you have a Windows computer, yes. If you have a Mac, run brew install powershell to find out. You will then be affected.
PS C:\Users\victim> Get-Answer "Is this being exploited in the wild?"
Yes. Telemetry shows sysadmins exploiting Power2Shell hundreds of times a day, often against hundreds of servers at once using Invoke-Command. Some have scheduled it to run at 2 a.m.
PS C:\Users\victim> Get-Answer "Can the attacker become Administrator?"
Only by right-clicking and choosing “Run as administrator,” then clicking Yes on the UAC prompt. The sudo2shell team already flagged this control. We have independently confirmed it.
PS C:\Users\victim> Get-Answer "Doesn’t Windows have sudo now?"
Windows 11 added Sudo for Windows in 24H2. We have forwarded this to sudo2shell.com, who were last seen running in circles.
PS C:\Users\victim> Get-Answer "What about curl?"
In Windows PowerShell 5.1, curl is an alias for Invoke-WebRequest, which is not curl. This is the only genuine crime described on this page.
PS C:\Users\victim> Get-Answer "Is this related to the other *2Shell vulnerabilities?"
Yes. Terminal2Shell gets you a window. Power2Shell fills it with verbs. sudo2shell makes them run as root, except on Windows, where you click Yes. Defenders should treat all three as one campaign run by the people who use computers.
PS C:\Users\victim> Get-Answer "Why is the CVE still pending?"
We tried to request one with New-CVE. The term was not recognized as the name of a cmdlet.
PS C:\Users\victim> Get-Answer "Should I panic?"
Run Get-Verb Panic. It returns nothing. Panic is not an approved verb. Use Invoke-Panic if you must. Invoke is approved, and nobody checks the noun.
Click a command to run it. Click it again to collapse the output.