CVE-2026-96303: CWE-358: Improperly Implemented Security Check for Standard in Microsoft PowerShell 7.4

This vulnerability (CVE-2026-96303) in Microsoft PowerShell 7.4 is due to an improperly implemented security check for a standard, which enables an unauthorized attacker to bypass a security feature remotely over a network. The CVSS 3.1 base score is 6.5 (medium severity), with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, no availability impact, and official remediation available. The affected versions are 7.4.0 through 7.4.20, 7.5.0 through 7.5.11, and 7.6.0 through 7.6.6. Microsoft has published an official fix for this vulnerability.

An attacker can bypass a security feature in affected versions of Microsoft PowerShell 7.4 remotely without privileges but requires user interaction. The integrity of the system can be compromised, but confidentiality and availability are not impacted. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users should apply the security updates for PowerShell versions 7.4.21 or later, 7.5.12 or later, and 7.6.7 or later as provided in the Microsoft advisory (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96303). No additional mitigation steps are indicated by the vendor.