EUVD-2026-43787
GHSA-wvqj-vj23-9cf7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable but requires an authenticated foothold (PR:L) and victim interaction (UI:R); traversal yields full code execution, so C/I/A all High with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Windows PowerShell allows an authenticated attacker with low privileges to run arbitrary code across a network by exploiting a relative path traversal (CWE-23) flaw, provided a victim is induced to interact (UI:R). Affecting supported Windows 10/11 clients and Windows Server 2012 through 2025, the issue carries a CVSS 8.0 with full confidentiality, integrity, and availability impact, and a vendor patch is available via MSRC. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Technical ContextAI
The vulnerability lies in Windows PowerShell, the scripting host and automation engine bundled with every supported Windows client and server edition. CWE-23 (Relative Path Traversal) means PowerShell fails to properly neutralize '../' sequences or other relative path elements in an input used to construct a file path, letting an attacker escape an intended directory and reference or execute code from an unintended location. Because PowerShell can load modules, scripts, and assemblies by path, a traversal in path resolution can turn a controlled relative reference into arbitrary code execution. The affected CPE set spans microsoft:windows_10 (1607, 1809, 21H2, 22H2), windows_11 (24H2, 25H2, 26H1), and windows_server_2012 through 2025 including Server Core installations, indicating the flawed component ships uniformly across the Windows platform rather than in a single edition.
RemediationAI
Apply the Microsoft security update for CVE-2026-40400; a vendor patch is available, so install the relevant monthly cumulative/security-only update for each affected Windows client and server SKU as listed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40400 (consult that page for the exact fixed build per OS version, as no single fix version string was supplied in the input). Prioritize Server Core and domain-joined systems where PowerShell remoting is enabled. As compensating controls until patching completes, restrict and monitor PowerShell remoting (WinRM/WS-Man on TCP 5985/5986) to trusted management hosts via firewall scoping and JEA, enforce PowerShell Constrained Language Mode and script/module signing to limit loading of attacker-controlled paths, and enable Script Block and Module logging plus AMSI to detect exploitation - noting these controls can break legitimate administrative automation and remoting workflows and should be validated in staging first.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today