CVE-2026-70338
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Improper control of generation of code (code injection) in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
Risk Assessment
A local attacker could bypass security features, potentially leading to unauthorized command execution or privilege escalation.
Recommendation
Update Microsoft PowerShell to the latest version containing the security fix.
Other vulnerabilities in Microsoft PowerShell
See all- CVE-2026-96251High
Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.
- CVE-2026-50523High
Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.
- CVE-2026-59119High
A vulnerability in Microsoft PowerShell is due to incorrect default permissions, allowing an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS