Local privilege escalation via administrator-to-guest session hijacking

PowerShell Direct session hijacking in Windows and PowerShell 7 allows local users to impersonate a host administrator to a guest VM. The PowerShell Direct channel is not bound to its intended endpoints, allowing another host user to intercept the administrator-to-guest session. Exploitation requires local low-privileged host access and an active session, after which guest-side operations can be manipulated or controlled.