Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-70338

Microsoft Powershell: code injection

Risk score
58/100
CVSS
7.8 v3.1
Exploit chance (30 days)
0.4%
Published
11 Aug 2026

Open in the live forecast Today's forecast

What to know

What it is
Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
Affected
Microsoft Powershell
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: Microsoft PowershellTHE FLAWSTHE FIXCVE-2026-70338Code injectionCVSS 7.8 · EPSS 0%CVE-2026-96251Reliance on untrusted inputs ina security decision inMicrosoft PowerShell allows…CVSS 8.8 · EPSS 1%CVE-2026-96303Improperly implementedsecurity check for standard inMicrosoft PowerShell allows…CVSS 6.5 · EPSS 1%FixCheck the linked advisory fordetails on the fix.Who is exposed{'products': ['MicrosoftPowerShell'], 'packages': [],'versions': []}AMBER · PATCH THIS WEEKMicrosoftPowershellA vulnerability in MicrosoftPowerShell allows anunauthorized attacker toexecute code over a network dueto reliance on untrusted inputsin a security decision.Where it standsNo known exploitationHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.22 Oct · Microsoft Security Response CenterCVE-2026-96251 Microsoft PowerShell RemoteCode Execution Vulnerability22 Oct · Microsoft Security Response CenterCVE-2026-96303 Microsoft PowerShell SecurityFeature Bypass Vulnerability26 Oct · Microsoft Security Response CenterCVE-2026-70338 Microsoft PowerShell SecurityFeature Bypass VulnerabilityCONNECTS TOSame weaknessCode injection (CWE-94)246 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Microsoft Powershell: Amber, patch this week. A vulnerability in Microsoft PowerShell allows an unauthorized attacker to execute code over a network due to reliance on untrusted inputs in a security decision.

The flaws

  • CVE-2026-70338: Code injection (CVSS 7.8 · EPSS 0%)
  • CVE-2026-96251: Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized… (CVSS 8.8 · EPSS 1%)
  • CVE-2026-96303: Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized… (CVSS 6.5 · EPSS 1%)

The fix

Fix: Check the linked advisory for details on the fix.

Who is exposed: {'products': ['Microsoft PowerShell'], 'packages': [], 'versions': []}

Where it stands

  • No known exploitation

How it unfolded

  1. 22 Oct, Microsoft Security Response Center (official): CVE-2026-96251 Microsoft PowerShell Remote Code Execution Vulnerability
  2. 22 Oct, Microsoft Security Response Center (official): CVE-2026-96303 Microsoft PowerShell Security Feature Bypass Vulnerability
  3. 26 Oct, Microsoft Security Response Center (official): CVE-2026-70338 Microsoft PowerShell Security Feature Bypass Vulnerability

Connects to

Why it is Yellow

  • CVSS 7.8 high
  • Named in a government or vendor bulletin

Government and vendor bulletins

References

Original description

Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

Last activity 26 Oct 2026. Patch Forecast updates every hour.