CVE-2026-26143: Microsoft PowerShell Security Feature Bypass Vulnerability
CVE-2026-26143 is a security feature bypass vulnerability in Microsoft PowerShell, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.54% probability of exploitation activity in the next 30 days, higher than 46% of all scored vulnerabilities. Microsoft released the fix on 14 April 2026 in the April 2026 Patch Tuesday. It affects 2 products in 1 product family (Developer Tools).
Key facts
- CVE ID
- CVE-2026-26143
- Severity
- High CVSS 7.8
- Microsoft severity
- Important
- Impact
- Security Feature Bypass
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-20
- EPSS
- 0.54% (percentile 46%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- April 2026 Patch Tuesday
- Product families
- Developer Tools
CVSS score and vector
Microsoft scores CVE-2026-26143 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
Frequently asked questions (Microsoft)
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker would have to send the victim a malicious file that the victim would have to execute.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
Exploiting this vulnerability bypasses dynamic-expression security checks which may lead to arbitrary code execution when then -SkipLimitCheck is used with Import-PowerShellDataFile. If you do not use the -SkipLimitCheck switch, you are not affected.
Is the Windows native version of PowerShell affected by this vulnerability?
No, this vulnerability was introduced after PowerShell was forked from Windows powerShell so the inbox version is not affected.
The current store app addresses the vulnerability.
Affected products (2)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| PowerShell 7.5 | Release Notes | Security Update | 7.5.5 | Maybe |
| PowerShell 7.4 |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 7.8 (HIGH)
- NVD weakness
- CWE-20
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| powershell | from 7.4, before 7.4.14 |
| powershell | from 7.5, before 7.5.5 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26143 (Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |