CVE-2026-40400 Overview
CVE-2026-40400 is a relative path traversal vulnerability [CWE-23] in Windows PowerShell that enables an authorized attacker to execute code over a network. The flaw affects a broad range of Windows client and server versions, including Windows 10, Windows 11, and Windows Server editions from 2012 through 2025. Exploitation requires low privileges and user interaction, but successful attacks compromise confidentiality, integrity, and availability. Microsoft has published a security advisory addressing the issue.
Critical Impact
Authenticated attackers can execute arbitrary code across a network by exploiting improper path validation in Windows PowerShell, impacting every currently supported Windows client and server release.
Affected Products
- Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 24H2, 25H2, 26H1)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2025
Discovery Timeline
- 2026-07-14 - CVE-2026-40400 published to the National Vulnerability Database
- 2026-07-16 - Last updated in NVD database
Technical Details for CVE-2026-40400
Vulnerability Analysis
The vulnerability resides in Windows PowerShell's handling of relative file paths. PowerShell fails to properly normalize or validate path input that contains directory traversal sequences such as ..\ before resolving the target resource. An authenticated attacker with network access can craft a request that traverses outside the intended directory scope, causing PowerShell to load or execute an attacker-controlled resource.
The attack requires user interaction, indicating the exploit chain likely involves a victim opening a crafted script, module, or file that triggers PowerShell to resolve the malicious path. Once the traversal succeeds, the attacker gains code execution in the context of the invoking user.
Root Cause
The root cause is improper limitation of a pathname to a restricted directory, classified as [CWE-23]. PowerShell's path resolution logic does not adequately sanitize input containing relative path components. When these unsanitized paths are used to locate scripts, modules, or configuration files, the runtime resolves them to locations outside the expected boundary and executes their contents.
Attack Vector
The attack originates over the network and requires the attacker to hold at least low-level privileges on the target environment. Delivery mechanisms may include shared network locations, remoting endpoints, or crafted PowerShell modules retrieved from attacker-controlled shares. The victim must perform an action, such as executing a script or importing a module, to trigger the traversal and subsequent code execution.
Technical exploitation details are not publicly available. Refer to the Microsoft Security Update CVE-2026-40400 advisory for authoritative guidance.
Detection Methods for CVE-2026-40400
Indicators of Compromise
- PowerShell process (powershell.exe or pwsh.exe) loading modules or scripts from UNC paths or user-writable directories outside standard module locations.
- Command-line arguments containing relative traversal sequences such as ..\ or ..// passed to PowerShell cmdlets.
- Unexpected child processes spawned by PowerShell following the import of a network-hosted module.
Detection Strategies
- Enable PowerShell Script Block Logging and Module Logging to capture executed commands and imported modules for retrospective analysis.
- Monitor Event ID 4104 for suspicious script blocks that reference relative paths targeting sensitive directories.
- Alert on PowerShell execution triggered from network shares, email attachments, or non-standard user directories.
Monitoring Recommendations
- Forward PowerShell operational and transcription logs to a centralized SIEM for correlation with authentication and file access events.
- Baseline normal PowerShell module load paths and flag deviations, especially imports from UNC paths.
- Track user-initiated PowerShell sessions on servers to detect anomalous interactive or remoting activity.
How to Mitigate CVE-2026-40400
Immediate Actions Required
- Apply the Microsoft security update for CVE-2026-40400 across all affected Windows client and server systems as soon as testing permits.
- Restrict PowerShell execution to signed scripts by enforcing an AllSigned or RemoteSigned execution policy.
- Audit and remove unnecessary write permissions on directories referenced by PowerShell module paths.
Patch Information
Microsoft has released security updates addressing this vulnerability. Refer to the Microsoft Security Update CVE-2026-40400 advisory for the specific KB articles and update packages that correspond to each affected Windows version.
Workarounds
- Disable PowerShell remoting on systems that do not require it using Disable-PSRemoting.
- Block outbound SMB and WebDAV traffic at the perimeter to prevent execution of scripts hosted on attacker-controlled shares.
- Enforce Constrained Language Mode via AppLocker or Windows Defender Application Control to limit PowerShell capabilities for standard users.
# Configuration example: enforce signed script execution and disable remoting
Set-ExecutionPolicy -ExecutionPolicy AllSigned -Scope LocalMachine
Disable-PSRemoting -Force
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
