EUVD-2026-43787
GHSA-wvqj-vj23-9cf7
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Network-reachable but requires an authenticated foothold (PR:L) and victim interaction (UI:R); traversal yields full code execution, so C/I/A all High with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Windows PowerShell allows an authenticated attacker with low privileges to run arbitrary code across a network by exploiting a relative path traversal (CWE-23) flaw, provided a victim is induced to interact (UI:R). Affecting supported Windows 10/11 clients and Windows Server 2012 through 2025, the issue carries a CVSS 8.0 with full confidentiality, integrity, and availability impact, and a vendor patch is available via MSRC. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Technical ContextAI
The vulnerability lies in Windows PowerShell, the scripting host and automation engine bundled with every supported Windows client and server edition. CWE-23 (Relative Path Traversal) means PowerShell fails to properly neutralize '../' sequences or other relative path elements in an input used to construct a file path, letting an attacker escape an intended directory and reference or execute code from an unintended location. Because PowerShell can load modules, scripts, and assemblies by path, a traversal in path resolution can turn a controlled relative reference into arbitrary code execution. The affected CPE set spans microsoft:windows_10 (1607, 1809, 21H2, 22H2), windows_11 (24H2, 25H2, 26H1), and windows_server_2012 through 2025 including Server Core installations, indicating the flawed component ships uniformly across the Windows platform rather than in a single edition.
RemediationAI
Apply the Microsoft security update for CVE-2026-40400; a vendor patch is available, so install the relevant monthly cumulative/security-only update for each affected Windows client and server SKU as listed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40400 (consult that page for the exact fixed build per OS version, as no single fix version string was supplied in the input). Prioritize Server Core and domain-joined systems where PowerShell remoting is enabled. As compensating controls until patching completes, restrict and monitor PowerShell remoting (WinRM/WS-Man on TCP 5985/5986) to trusted management hosts via firewall scoping and JEA, enforce PowerShell Constrained Language Mode and script/module signing to limit loading of attacker-controlled paths, and enable Script Block and Module logging plus AMSI to detect exploitation - noting these controls can break legitimate administrative automation and remoting workflows and should be validated in staging first.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today