CVE-2026-96251: Microsoft PowerShell Remote Code Execution Vulnerability
Summary
CVE-2026-96251: Microsoft PowerShell Remote Code Execution Vulnerability. Affects powershell across 3 version ranges.
>= 7.4.0, < 7.4.21
>= 7.5.0, < 7.5.12
>= 7.6.0, < 7.6.7
Fixed in 7.4.21, 7.5.12 or 7.6.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Microsoft PowerShell is a task automation and configuration management framework, consisting of a command-line shell and associated scripting language. It is widely used for managing system configurations and automating administrative tasks. However, this version has a critical vulnerability that allows unauthorized code execution over a network, posing significant security risks.
Vulnerability Detail
The vulnerability arises from PowerShell's reliance on untrusted inputs in security decisions. This flaw enables an unauthorized attacker to execute arbitrary code remotely, potentially leading to data breaches, system compromises, and unauthorized access to sensitive information. The vulnerability affects multiple versions of PowerShell, specifically those introduced in versions 7.4.0, 7.5.0, and 7.6.0, with fixes available in subsequent releases.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.4.0, < 7.4.217.4.21 -
>= 7.5.0, < 7.5.127.5.12 -
>= 7.6.0, < 7.6.77.6.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider restricting network access to PowerShell or implementing strict input validation to mitigate the risk of unauthorized code execution.
Conclusion
CVE-2026-96251 represents a significant security risk for users of Microsoft PowerShell, allowing unauthorized remote code execution. It is crucial to update to the latest patched versions to mitigate this vulnerability and protect your systems.
See every vulnerability recorded for powershell →
FAQ
CVE-2026-96251 is a vulnerability in Microsoft PowerShell that allows unauthorized remote code execution due to reliance on untrusted inputs.
Versions 7.4.0, 7.5.0, and 7.6.0 are affected, with fixes available in versions 7.4.21, 7.5.12, and 7.6.7.
You can check your PowerShell version by running 'pwsh -v' in your terminal. If your version is below the patched versions, you are vulnerable.
The risks include unauthorized access to systems, data breaches, and the potential for attackers to execute malicious code remotely.
Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just a manifest file like package-lock.json. You can check if your application is affected by this vulnerability using the Vulert playground.
References
Related vulnerabilities
Recent vulnerabilities recorded for powershell.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
