CVE-2026-50523: Microsoft PowerShell Remote Code Execution Vulnerability
Summary
CVE-2026-50523: Microsoft PowerShell Remote Code Execution Vulnerability. Affects powershell across 3 version ranges.
>= 7.4.0, < 7.4.19
>= 7.5.0, < 7.5.10
>= 7.6.0, < 7.6.5
Fixed in 7.4.19, 7.5.10 or 7.6.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Microsoft PowerShell is a task automation and configuration management framework, consisting of a command-line shell and associated scripting language. It is widely used for automating administrative tasks and managing system configurations. However, it is susceptible to vulnerabilities that can allow unauthorized code execution, particularly through command injection flaws.
Vulnerability Detail
The vulnerability identified as CVE-2026-50523 arises from improper neutralization of special elements used in commands, leading to command injection. An authorized attacker can exploit this flaw to execute arbitrary code locally, potentially compromising system integrity and confidentiality. The severity of this vulnerability is rated high, with a CVSS score of 7.5, indicating significant risk to affected systems.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.4.0, < 7.4.197.4.19 -
>= 7.5.0, < 7.5.107.5.10 -
>= 7.6.0, < 7.6.57.6.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can limit the execution of PowerShell scripts by adjusting the execution policy. This can be done by running the following command in PowerShell:
Set-ExecutionPolicy -ExecutionPolicy Restricted
This will prevent the execution of scripts until the vulnerability is patched.
Conclusion
CVE-2026-50523 represents a significant risk to users of Microsoft PowerShell due to its potential for remote code execution through command injection. It is crucial for users to update to the latest patched versions to mitigate this vulnerability and protect their systems.
See every vulnerability recorded for powershell →
FAQ
CVE-2026-50523 is a vulnerability in Microsoft PowerShell that allows unauthorized code execution through command injection.
You can check your PowerShell version by running the command 'Get-Host' in the PowerShell terminal. If your version is below 7.4.19, 7.5.10, or 7.6.5, it is affected.
Exploitation of this vulnerability can lead to unauthorized access, data breaches, and potential system compromise.
Yes, Vulert can monitor and alert in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for powershell.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
