Microsoft's August release includes three PowerShell vulnerabilities covering remote code execution, security-feature bypass, and elevation of privilege. The important operational detail is that PowerShell 7 is serviced independently from Windows PowerShell and can exist in several versions on the same system. A fully patched operating system does not prove that every `pwsh` binary used by automation is current.
Why it matters in production
The inventory must look beyond administrator laptops. Jump hosts, task servers, CI runners, configuration-management nodes, monitoring servers, backup consoles, container images, and packaged tools can all carry their own runtime. Record executable paths, versions, architecture, installation channel, service or scheduled-task references, module paths, and owners. Searching only the system PATH misses pinned or bundled copies.
Updating the runtime needs compatibility tests. Representative scripts should connect to Active Directory, SQL Server, VMware, Veeam, and other managed platforms with the same modules and credentials used in production. Check remoting, TLS negotiation, serialization, native-command behavior, error handling, transcript creation, and non-interactive execution. A security upgrade that stops silently in a task scheduler creates a new operational risk.
Servicing ownership should be explicit. Decide whether packages arrive through MSI management, Microsoft Update, an internal repository, or a controlled deployment script. Pin approved versions where reproducibility matters, but pair the pin with a review cadence. Module inventories and execution policies do not replace runtime patching, and an old runner should not remain trusted merely because its scripts are signed.
Practical takeaway
The practical takeaway is to treat PowerShell as an application platform. Discover every runtime, patch it through an owned channel, test the real automation estate, and monitor failures after rollout. The most important PowerShell update may never arrive through the same mechanism as the operating system beneath it.