Microsoft PowerShell: Remote code execution via untrusted inputs

Summary

Microsoft PowerShell 7 contains a flaw in a security decision that relies on untrusted input (CWE-807). According to Microsoft, an unauthorized attacker can execute code over the network, but user interaction is required. Affected are PowerShell 7.4, 7.5 and 7.6 before the fixed builds. Microsoft rates exploit maturity as Unproven and no public exploit is known.

Affected

• PowerShell 7.4.0 to before 7.4.21
• PowerShell 7.5.0 to before 7.5.12
• PowerShell 7.6.0 to before 7.6.8

Fixed in

• PowerShell 7.4.21 or later
• PowerShell 7.5.12 or later
• PowerShell 7.6.8 or later (the official CVE record says 7.6.8; some sources cite 7.6.7, so verify against the MSRC page)

Workaround

Unknown. No vendor-documented workaround exists. Downgrading to an earlier PowerShell version reintroduces the vulnerability and is not a mitigation.

Exploitation

• Microsoft rates exploit maturity as Unproven.
• CISA SSVC: exploitation none, automatable no, technical impact total.
• No evidence of exploitation in the wild found.

Our recommendation

• Inventory pwsh versions on Windows, macOS and Linux (pwsh -v).
• Update PowerShell 7 to 7.4.21, 7.5.12 or 7.6.8 or later.
• Prioritise admin workstations, jump hosts and management systems.
• Limit PowerShell sessions to trusted hosts until patching is complete.
• Do not downgrade to older versions as a workaround.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96251 msrc.microsoft.com
• PowerShell Announcements: CVE-2026-96251 github.com
• NVD record via OpenCVE: CVE-2026-96251 app.opencve.io
• OSV/Bitnami: BIT-powershell-2026-96251 osv.dev

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 17:54.