PowerShell Direct Elevation of Privilege Vulnerability

What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker, initially a non-admin user on the host, could hijack the PowerShell Direct session intended for communication between the admin user on host and a guest VM. This unauthorized access enables the attacker to impersonate the admin host user in communications with the guest, potentially manipulating or controlling guest-side operations.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition.

Why am I getting login failure events on my unpatched guest VM?
To ensure compatibility with unpatched guests, the new client attempts a login. This will produce an event in the Security Event log with event id 4625. The username will be ?‹PSDirectVMLegacy> and the domain will be 䕖卒佉N.
This event should stop when you patch your guest.

Where can I find information about additional mitigation steps?
There are edge case affecting hotpatched devices that have installed the September 2025 updates . These devices may experience failures with PowerShell Direct (PSDirect) connections when the host and guest virtual machines (VMs) are both not fully updated.
If your hotpatched device is experiencing issues with PSDirect connection, we recommend updating both the host and guest VM with these updates.
Additional information can be found in the Knowledge Base articles below.
5065306: 5065306, Windows Server 2022 Hotpatch: Windows Server 2022 Hotpatch, 5065426: 5065426, Windows 11, version 24H2: Windows 11, version 24H2, 5065432: 5065432, Windows Server 2022: Windows Server 2022, 5065474: 5065474, Windows Server 2025 Hotpatch: Windows Server 2025 Hotpatch, 5066359: 5066359, PowerShell: PowerShell, 5066360: 5066360, PowerShell: PowerShell

Security updates
10.0.17763.7792 — https://support.microsoft.com/help/5065428
10.0.20348.4171 — https://support.microsoft.com/help/5065432
10.0.20348.4106 — https://support.microsoft.com/help/5065306
10.0.19044.6332 — https://support.microsoft.com/help/5065429
10.0.22621.5909 — https://support.microsoft.com/help/5065431
10.0.26100.6584 — https://support.microsoft.com/help/5065426
10.0.26100.6508 — https://support.microsoft.com/help/5065474
10.0.25398.1849 — https://support.microsoft.com/help/5065425
10.0.14393.8422 — https://support.microsoft.com/help/5065427
7.4.12 — https://github.com/PowerShell/Announcements/issues/78