CVE-2026-26170: Microsoft PowerShell Privilege Escalation

CVE-2026-26170 Overview

CVE-2026-26170 is an improper input validation vulnerability in Microsoft PowerShell that allows an authorized attacker to elevate privileges locally. This vulnerability stems from insufficient validation of user-supplied input within PowerShell, enabling attackers with local access and low-level privileges to escalate their access to higher privilege levels on affected systems.

Critical Impact

Local privilege escalation via improper input validation could allow attackers to gain elevated access, potentially compromising confidentiality, integrity, and availability of the affected system.

Affected Products

• Microsoft PowerShell

Discovery Timeline

• April 14, 2026 - CVE-2026-26170 published to NVD
• April 14, 2026 - Last updated in NVD database

Technical Details for CVE-2026-26170

Vulnerability Analysis

This vulnerability is classified under CWE-20 (Improper Input Validation), indicating that PowerShell fails to adequately validate or sanitize input before processing. The attack requires local access to the system and low-level privileges to execute. Once exploited, the vulnerability enables complete compromise of the affected system's confidentiality, integrity, and availability through unauthorized privilege elevation.

The local attack vector means that an attacker must already have some form of access to the target system, either through physical access, remote desktop, SSH, or through another compromised application running on the system. From this foothold, the improper input validation flaw can be leveraged to execute operations with elevated privileges beyond what the attacker's account should permit.

Root Cause

The root cause of CVE-2026-26170 is improper input validation (CWE-20) within Microsoft PowerShell. The affected component fails to properly validate, filter, or sanitize user-controlled input before processing it. This allows carefully crafted input to bypass security controls and trigger unintended behavior that results in privilege escalation.

Attack Vector

The attack vector for this vulnerability is local, meaning an attacker must have prior access to the target system. The exploitation process involves:

1. An attacker with low-privilege local access identifies the vulnerable PowerShell installation
2. The attacker crafts malicious input designed to exploit the input validation weakness
3. When processed by PowerShell, this input bypasses security checks
4. The attacker gains elevated privileges on the local system

The vulnerability does not require user interaction, making exploitation straightforward once an attacker has established local access. For detailed technical information, refer to the Microsoft CVE-2026-26170 Update Guide.

Detection Methods for CVE-2026-26170

Indicators of Compromise

• Unexpected PowerShell processes running with elevated privileges (SYSTEM or Administrator) spawned from low-privilege user contexts
• Abnormal PowerShell command-line arguments or script execution patterns
• Unusual privilege escalation events in Windows Security Event Logs (Event ID 4672, 4673)

Detection Strategies

• Monitor Windows Security Event Logs for privilege escalation attempts (Event ID 4672 - Special privileges assigned to new logon)
• Implement PowerShell Script Block Logging and Module Logging to capture detailed command execution
• Deploy endpoint detection rules to identify suspicious PowerShell activity patterns associated with privilege escalation
• Monitor for anomalous process creation chains where low-privilege PowerShell spawns high-privilege child processes

Monitoring Recommendations

• Enable PowerShell Transcription Logging to capture all PowerShell input and output
• Configure Windows Event Forwarding to centralize PowerShell and security logs for correlation
• Implement behavioral analytics to detect unusual privilege elevation patterns on endpoints
• Monitor process integrity levels and privilege token modifications on critical systems

How to Mitigate CVE-2026-26170

Immediate Actions Required

• Apply the latest Microsoft security updates for PowerShell immediately
• Review and restrict PowerShell execution policies on critical systems using Set-ExecutionPolicy cmdlet
• Implement PowerShell Constrained Language Mode on sensitive systems to limit available cmdlets and language elements
• Audit local user accounts and remove unnecessary elevated privileges following principle of least privilege

Patch Information

Microsoft has released security updates to address CVE-2026-26170. Organizations should consult the Microsoft CVE-2026-26170 Update Guide for specific patch information and download links. Apply patches through Windows Update, Windows Server Update Services (WSUS), or Microsoft Update Catalog based on your organization's patch management process.

Workarounds

• Enable PowerShell Constrained Language Mode to restrict available language elements and cmdlets
• Implement Application Control policies (Windows Defender Application Control or AppLocker) to restrict unauthorized PowerShell script execution
• Configure PowerShell Just Enough Administration (JEA) to limit administrative capabilities to specific authorized tasks
• Temporarily disable PowerShell remoting on systems where it is not required using Disable-PSRemoting cmdlet

# Enable Constrained Language Mode via environment variable
[Environment]::SetEnvironmentVariable('__PSLockdownPolicy', '4', 'Machine')

# Configure PowerShell execution policy to restrict script execution
Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope LocalMachine -Force

# Enable PowerShell Script Block Logging via registry
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 -PropertyType DWORD -Force