CVE-2026-96251: CWE-807: Reliance on Untrusted Inputs in a Security Decision in Microsoft PowerShell 7.4

This vulnerability, identified as CWE-807, occurs in Microsoft PowerShell 7.4 where the software improperly relies on untrusted inputs when making security decisions. This can enable an attacker without privileges to execute arbitrary code remotely. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. Affected versions include PowerShell 7.4.0 up to but not including 7.4.21, 7.5.0 up to but not including 7.5.12, and 7.6.0 up to but not including 7.6.7. Microsoft has published an official fix for this vulnerability.

Successful exploitation allows an unauthorized attacker to execute arbitrary code remotely, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability of the system. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates that address this vulnerability by upgrading to PowerShell versions 7.4.21 or later, 7.5.12 or later, or 7.6.7 or later as appropriate. Refer to the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96251 for detailed patching instructions.