CVE-2026-96251: Microsoft PowerShell Remote Code Execution Vulnerability

Overview

Severity

High (CVSS 8.8)

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Category

Remote Code Execution

Exploit Status

Not Exploited

Exploitation Likelihood

Less Likely

Patch Tuesday

2026-Oct

Released

2026-10-13

Description

Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.

FAQ

How could an attacker exploit this vulnerability? An attacker could host a malicious server and convince a user to connect to it from an affected client. When the client processes the server's response, the attacker could execute code on the client system. User interaction is required.

Affected Products (3)

Developer Tools

• PowerShell 7.4
• PowerShell 7.6
• PowerShell 7.5

Security Updates (3)

• Release Notes
• Release Notes
• Release Notes

Acknowledgments

<a href="https://linkedin.com/in/weeraphat-srisutham">Weeraphat Srisutham</a>, <a href="https://www.linkedin.com/in/fcripolles/">Francisco Jos&#233; Carot Ripoll&#233;s (RipFran)</a> with <a href="https://www.linkedin.com/company/kpmg-espana/">KPMG Spain</a>, Anonymous, hwiseong, Coşkun Bağrıa&#231;ık, Raffaello Tamagnini, <a href="https://www.linkedin.com/in/hyunalee0327/">Hyuna Lee</a>, <a href="https://imap143.com/">Myungyong Lee</a>, <a href="https://x.com/idanmasas">Idan Masas</a> with <a href="https://masastechnologies.com/">Masas Technologies, LLC</a>

Revision History

• 2026-10-13: Information published.