Windows Defender Application Control Security Feature Bypass Vulnerability

<p>A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would be blocked by WDAC.</p> <p>To exploit the vulnerability, an attacker need administrator access on a local machine where PowerShell is running. The attacker could then connect to a PowerShell session and send commands to execute arbitrary code.</p> <p>The update addresses the vulnerability by correcting how PowerShell commands are validated when WDAC protection is enabled.</p>

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

N/A

Microsoft Windows Defender 安全漏洞

Microsoft Windows Defender是美国微软（Microsoft）公司的一套Windows系统附带的防病毒软件。 Microsoft Windows Defender 存在安全漏洞，该漏洞源于存在可能允许攻击者绕过 WDAC 强制执行的安全功能绕过漏洞。攻击者可利用该漏洞执行通常会被 WDAC 阻止的 PowerShell 命令以下产品及版本受到影响： Windows 10 1909版本， Windows 10 1709版本， Windows Server 1909版本， Windows

N/A

N/A