CVE-2026-96251
8.8HighPublished 13 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-807
Impact
Attackers can execute arbitrary code over the network, but it requires user interaction to trigger. No prior authentication is needed.
Root cause
PowerShell improperly relies on untrusted inputs when making security decisions.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Check the Microsoft Security Update Guide advisory for the specific patched PowerShell package and install it immediately. No interim mitigations are provided in the advisory.
$ pwsh --versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.