CVE-2026-96303: Microsoft PowerShell Security Feature Bypass Vulnerability

Vulnerability Overview and Official Advisory Facts​

According to the Microsoft Security Response Center (MSRC) advisory for CVE-2026-96303, the official description states:

Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network.

Click to expand...

The flaw is classified under CWE-358 (Improperly Implemented Security Check for Standard). In practical terms, the official advisory facts clarify both the root issue and the exact defensive boundaries at risk:

• Microsoft PowerShell Security Feature Bypass Vulnerability: Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network.
• What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could bypass Windows Defender Application Control and PowerShell Constrained Language Mode restrictions, allowing untrusted code to run with capabilities those protections are designed to block.

For defenders who rely on Windows Defender Application Control (WDAC) and PowerShell Constrained Language Mode to restrict interactive scripts and block arbitrary API invocations, this detail is the heart of the advisory. When Constrained Language Mode is enforced alongside WDAC, PowerShell is supposed to limit untrusted scripts to a safe subset of core commands and prevent them from invoking unrestricted system types. Bypassing both controls allows untrusted code to execute with capabilities that those protections are engineered to prevent.

Technical Severity, CVSS Breakdown, and Threat Status​

Microsoft's assessment assigns CVE-2026-96303 a CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C vector string. Breaking down the components of this vector explains how the attack surface behaves:

• Attack Vector (AV:N) & Attack Complexity (AC:L): The vulnerability is exploitable over a network with low attack complexity.
• Privileges Required (PR:N) & User Interaction (UI:R): An unauthorized attacker needs no prior privileges, though exploitation requires user interaction—such as convincing a user to run or interact with untrusted input in an environment where PowerShell protections are expected to contain it.
• Scope (S:U) & Impact (C:N/I:H/A:N): While there is no direct confidentiality or availability score impact in the vector itself, integrity impact is rated High (I:H) because a security boundary enforcing trusted execution is bypassed.
• Temporal Metrics (E:U/RL:O/RC:C): Unproven exploit maturity (E:U), an official fix (RL:O), and confirmed report confidence (RC:C) bring the 6.5 base score to a 5.7 temporal score.

The current status indicators from the official MSRC record are as follows:

• Severity: Important
• CVSS Base Score: 6.5
• CVSS Temporal Score: 5.7
• Weakness: CWE-358
• Publicly disclosed: No
• Exploited: No
• Exploitation Assessment: Exploitation Less Likely
• Customer action required: Yes

Section Summary: While CVE-2026-96303 is rated Exploitation Less Likely with Publicly disclosed: No and Exploited: No, its ability to undermine Windows Defender Application Control and PowerShell Constrained Language Mode makes patching essential for hardened workstations and servers.

Affected Products, Fixed Builds, and Remediation​

Because Customer action required: Yes applies to this release, organizations and individual users running PowerShell 7.4, PowerShell 7.5, or PowerShell 7.6 must update their installations to the respective fixed builds.

To ensure full compliance across all supported releases covered by the advisory, follow the exact remediation guidance provided by Microsoft:

• For PowerShell 7.4, update to fixed build 7.4.21 or later. For PowerShell 7.5, update to fixed build 7.5.12 or later. For PowerShell 7.6, update to fixed build 7.6.8 or later.

Practical Guidance for Administrators​

In environments where Windows Defender Application Control and PowerShell Constrained Language Mode are deployed, security teams depend on the integrity of PowerShell's internal policy checks (CWE-358) to enforce least-privilege scripting. Administrators should inventory all endpoints, developer machines, and management hosts running PowerShell 7.4, PowerShell 7.5, and PowerShell 7.6, and deploy builds 7.4.21, 7.5.12, and 7.6.8 (or later) respectively so that untrusted code cannot bypass WDAC and Constrained Language Mode restrictions.