Windows PowerShell CVE-2026-40400

Per the CVSS vector, exploitation requires the attacker to already hold some authenticated privilege on or reachable to the target (PR:L) and requires user interaction (UI:R) - a victim must be induced to trigger the vulnerable PowerShell path resolution (for example by running a supplied script, module, or command that references an attacker-controlled relative path). The attack is network-based (AV:N) with low complexity (AC:L) and does not cross a privilege/scope boundary (S:U). Limiting factors that reduce realistic risk: it is not exploitable fully unauthenticated, it cannot succeed without user interaction, and it depends on the PowerShell relative-path-handling code path being reached - meaning environments that restrict PowerShell remoting, enforce Constrained Language Mode, or block untrusted script execution materially raise the difficulty.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, 8.0 High) describes a network-reachable, low-complexity attack that nonetheless requires both some level of authenticated privilege (PR:L) and victim interaction (UI:R), which meaningfully raises the bar versus a fully unauthenticated wormable flaw. High impact across all three CIA dimensions makes the technical consequence severe if triggered. No EPSS score, KEV entry, or POC was provided in the intelligence, so real-world exploitation likelihood cannot be quantified from the data; the combination of required privileges and user interaction typically correlates with lower mass-exploitation probability. This is a genuine patch-priority item on any Windows fleet given the enormous install base, but the PR:L + UI:R conditions suggest it is more suited to targeted or phishing-assisted attacks than untargeted worming. Note that the CPE strings use the 'a' (application) part for PowerShell while the platform is the OS - verify affected build numbers against the MSRC advisory before scoping.

An attacker holding a low-privilege authenticated foothold sends a specially crafted request or lure that causes a targeted user's PowerShell session to resolve a malicious relative path, and once the victim interacts (e.g., runs a script or opens a supplied item) the traversal loads attacker-controlled code that executes with the victim's rights. No public POC was identified at time of analysis, so exploitation would currently require independent development against the traversal in PowerShell's path handling.