CVE-2026-70338: Microsoft PowerShell Security Feature Bypass Vulnerability
CVE-2026-70338 is a security feature bypass vulnerability in Microsoft PowerShell, rated Important by Microsoft, with a CVSS 3.1 base score of 7.8 (High). An attacker can exploit it by an attacker with local access, without any privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.36% probability of exploitation activity in the next 30 days, higher than 30% of all scored vulnerabilities. Microsoft released the fix on 11 August 2026 in the August 2026 Patch Tuesday. It affects 3 products in 1 product family (Developer Tools).
Key facts
- CVE ID
- CVE-2026-70338
- Severity
- High CVSS 7.8
- Microsoft severity
- Important
- Impact
- Security Feature Bypass
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-94
- EPSS
- 0.36% (percentile 30%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2026 Patch Tuesday
- Product families
- Developer Tools
CVSS score and vector
Microsoft scores CVE-2026-70338 at 7.8 (temporal 6.8) using CVSS 3.1. Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Local |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | Required |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | High |
| Availability impact | High |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Description
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
Frequently asked questions (Microsoft)
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass Windows Defender Application Control and PowerShell Constrained Language Mode restrictions, allowing untrusted code to run with capabilities those protections are designed to block.
Affected products (3)
Developer Tools
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| PowerShell 7.4 | Security update | Security Update | 7.4.19.0 | Maybe |
| PowerShell 7.5 | Security update | Security Update | 7.5.10.0 | Maybe |
| PowerShell 7.6 | Security update | Security Update | 7.6.5 | Maybe |
NIST NVD data
- NVD status
- Analyzed
- NVD CVSS
- 7.8 (HIGH)
- NVD weakness
- CWE-94
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| powershell | from 7.4, before 7.4.19.0 |
| powershell | from 7.5, before 7.5.10.0 |
| powershell | from 7.6, before 7.6.5 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70338 (Vendor Advisory)
Acknowledgments
- Ayato Shitomi
- Charlie Vogt
- Coşkun Bağrıaçık
- MinhNV5 with MBBank
- YMsora
- 陳宥升 (CheN..)
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. | |
| 2.0 | The security updates for Powershell have been updated. | |
| 2.1 | Acknowledgement Updated | |
| 2.2 | Acknowledgement Updated | |
| 2.3 | Updated an acknowledgement. This is an informational change only. |