CVE-2026-96251: Microsoft PowerShell Remote Code Execution Vulnerability

Vulnerability Overview and Official Status​

According to the Microsoft Security Response Center (MSRC) advisory, the core description of the issue is straightforward: reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network. The weakness is tracked under CWE-807 (Reliance on Untrusted Inputs in a Security Decision).

For defenders triaging their patch queues, Microsoft provides the following official status indicators and scoring metrics for CVE-2026-96251:

• CVE ID: CVE-2026-96251
• Title: Microsoft PowerShell Remote Code Execution Vulnerability
• Severity: Important
• CVSS Base Score: 8.8
• CVSS Temporal Score: 7.7
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
• Weakness (CWE): CWE-807
• Exploitation Assessment: Exploitation Less Likely
• Publicly disclosed: No
• Exploited: No
• Customer action required: Yes

Summary of the Advisory Metrics​

While the vulnerability has not been publicly disclosed or exploited in the wild, and Microsoft assesses its exploitation as Exploitation Less Likely, the high impact across confidentiality, integrity, and availability (C:H/I:H/A:H) means customer action is explicitly required to secure affected environments.

How Exploitation Works: The Untrusted Server Trap​

How could an attacker exploit this vulnerability? As documented in the official advisory facts, an attacker could host a malicious server and convince a user to connect to it from an affected client. When the client processes the server's response, the attacker could execute code on the client system. User interaction is required.

Breaking down the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C) alongside CWE-807 helps explain why this is classified as Important rather than Critical, despite the 8.8 base score:

1. Network Attack Vector (AV:N) with Low Complexity (AC:L) and No Privileges Required (PR:N): The attacker does not need prior authentication on the victim's machine. They only need to stand up a rogue endpoint over a network.
2. User Interaction Required (UI:R): The exploit cannot trigger purely on its own against an idle system. A user or administrator running an affected PowerShell client must be convinced to initiate a connection to the attacker's malicious server.
3. Reliance on Untrusted Inputs (CWE-807): When the affected PowerShell client receives and processes the response from that malicious server, it relies on untrusted data from the server to make a security decision, allowing arbitrary code execution within the context of the client system.

In practical IT terms, think of how often engineers run scripts or interactive sessions that reach out to external endpoints, test staging servers, or pull data from remote hosts. If social engineering or a poisoned configuration convinces a user to connect an unpatched PowerShell 7.x client to an adversary-controlled server, the server's response alone is enough to compromise the client.

Summary of the Attack Mechanism​

This is a client-side remote code execution flaw triggered by connecting to a malicious server. Because the affected PowerShell client trusts server-supplied inputs during a security decision, processing the server's response allows the remote host to execute code on the user's machine.

Affected Products and Remediation​

Microsoft has released fixed builds across all three affected branches of PowerShell. Because these updates are delivered as direct version upgrades rather than traditional Windows Update KB packages, administrators must ensure their standalone, MSI, or package-manager installations of PowerShell 7 are brought up to the minimum fixed builds listed below.

To reiterate the exact vendor remediation across your fleet:

• For PowerShell 7.4, update to fixed build 7.4.21 or later.
• For PowerShell 7.5, update to fixed build 7.5.12 or later.
• For PowerShell 7.6, update to fixed build 7.6.8 or later.

Practical Guidance for Administrators​

Based on general industry administration practices for PowerShell 7 environments, IT teams should take a quick inventory of developer workstations, jump boxes, and automation runners:

• Verify Installed Versions: You can check the active version in any PowerShell 7 console by inspecting $PSVersionTable.PSVersion. If a machine reports a 7.4.x build below 7.4.21, a 7.5.x build below 7.5.12, or a 7.6.x build below 7.6.8, it requires an update.
• Check Side-by-Side Installations: PowerShell 7 installs side-by-side with Windows PowerShell and can also exist in multiple portable or preview directories on developer rigs. Make sure endpoint management tools scan for all installed instances of pwsh across the file system.
• Exercise Caution with Untrusted Endpoints: Until fixed builds (7.4.21, 7.5.12, or 7.6.8) are deployed everywhere, remind users and administrators not to connect PowerShell clients to unverified or untrusted remote servers.

Final Takeaway​

CVE-2026-96251 is a textbook reminder that network clients must treat server responses as hostile until proven otherwise. Updating PowerShell 7.4 to 7.4.21, PowerShell 7.5 to 7.5.12, and PowerShell 7.6 to 7.6.8 closes the CWE-807 weakness and ensures your administrative shell stays under your control.