SB2026101428 - Multiple vulnerabilities in PowerShell

Description

This security bulletin contains information about 2 vulnerabilities.

1) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-96251)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to execute arbitrary code on the client system.

The vulnerability exists due to reliance on untrusted inputs in a security decision in the Microsoft PowerShell client when processing a server's response. A remote attacker can host a malicious server and convince a user to connect to it from an affected client to execute arbitrary code on the client system.

2) Improperly implemented security check for standard (CVE-ID: CVE-2026-96303)

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to bypass Windows Defender Application Control and PowerShell Constrained Language Mode restrictions.

The vulnerability exists due to an improperly implemented security check for a standard in Microsoft PowerShell when enforcing security restrictions. A remote attacker can exploit the security check over a network to bypass Windows Defender Application Control and PowerShell Constrained Language Mode restrictions.

Successful exploitation requires user interaction.

Remediation

Install update from vendor's website.

References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96251
• https://github.com/PowerShell/Announcements/blob/main/pwsh/2026/10/CVE-2026-96251.md
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2026-96303
• https://github.com/PowerShell/Announcements/blob/main/pwsh/2026/10/CVE-2026-96303.md