Windows PowerShell: Remote code execution through untrusted inputs

Summary

Windows PowerShell relies on untrusted inputs in a security decision, which allows an unauthorized attacker to execute code over a network. Microsoft scores it CVSS 8.8 (High), but the vector also requires user interaction, which conflicts with the description's wording on the attacker. Supported and unsupported Windows 10, Windows 11 and Windows Server 2012 to 2016 systems below the fixed builds are affected.

Affected

• Windows 10 Version 1607 and Windows Server 2016: below 10.0.14393.9612
• Windows 10 Version 1809: below 10.0.17763.9376
• Windows 10 21H2 and 22H2: below 10.0.19044.7807 and 10.0.19045.7807
• Windows 11 23H2: below 10.0.22631.7652
• Windows 11 24H2, 25H2 and 26H2: below 10.0.26100.9711, 10.0.26200.9711 and 10.0.26300.9711
• Windows 11 26H1: below 10.0.28000.3231
• Windows Server 2012 and 2012 R2 (including Server Core): below 6.2.9200.26434 and 6.3.9600.23470

Fixed in

• Install the October 2026 cumulative update for the affected Windows version. The fixed builds are listed above.
• KB numbers for Windows 10 1607 and Windows Server 2016: Unknown.

Workaround

• Unknown. No vendor-documented workaround was found, and patching is the only fix named in the sources.
• If no patch is available, restrict PowerShell remoting (WinRM) and network access to the affected host. This is a recommendation, not a vendor mitigation.

Exploitation

• No known exploitation as of 31 October 2026. CISA SSVC lists exploitation as none.
• Exploit code maturity is Unproven (E:U). No public proof of concept was found.
• EPSS was about 0.7% at the time of the search.

Our recommendation

• Inventory all Windows 10 1607, Windows Server 2016 and other affected hosts, and confirm whether they are still supported.
• Install the October 2026 updates on all supported systems. Plan replacement or isolation for unsupported systems.
• Restrict WinRM and network access to unpatched hosts, and monitor for changes in exploitation status (CISA KEV, MSRC revisions).
• Check the MSRC advisory directly to confirm the fixed builds and KB numbers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-85817 msrc.microsoft.com
• Vulners NVD mirror: CVE-2026-85817 vulners.com
• Vulners MSCVE mirror: CVE-2026-85817 vulners.com
• Patchapalooza: CVE-2026-85817 patchapalooza.com
• Strix: CVE-2026-85817 www.strix.ai
• OpenCVE: CVE-2026-85817 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:21.