CVE-2026-62801: Windows PowerShell Path Traversal Vulnerability

CVE-2026-62801 Overview

CVE-2026-62801 is a path traversal vulnerability in Windows PowerShell that allows an unauthorized attacker to bypass a security feature over a network. The flaw stems from improper limitation of a pathname to a restricted directory [CWE-22]. An attacker exploiting this issue can influence file resolution to reach locations outside intended boundaries, undermining an integrity-related security control. Exploitation requires user interaction but no prior authentication. Microsoft published the advisory on September 8, 2026.

Critical Impact
Successful exploitation lets a remote, unauthenticated attacker bypass a PowerShell security feature and compromise integrity when a user is convinced to trigger the vulnerable code path.

Affected Products

Windows PowerShell (see the Microsoft Security Update Guide for the current list of affected builds)

Discovery Timeline

2026-09-08 - CVE-2026-62801 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-62801

Vulnerability Analysis

The vulnerability affects how Windows PowerShell resolves and validates pathnames intended to remain within a restricted directory. An attacker can supply a crafted path that escapes the expected boundary using traversal sequences. Because the check occurs before or without full canonicalization, PowerShell operates on a resolved location outside the intended scope.

The issue is classified as path traversal [CWE-22]. The attack targets integrity: the impact scope covers modification of files or bypass of a security feature that relies on directory containment. Confidentiality and availability are not directly affected. The vulnerability is exploitable across a network and requires user interaction, such as running a script or opening content delivered by the attacker.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory. PowerShell logic responsible for enforcing directory containment does not sufficiently normalize or validate input paths before use. Sequences such as ..\ or alternative path representations reach filesystem APIs, allowing access to resources the security feature was designed to protect.

Attack Vector

Delivery occurs over a network vector with required user interaction. A likely scenario involves an attacker hosting or sending a PowerShell script, module, or file reference that the victim opens or executes. The crafted path resolves outside its intended sandbox, bypassing the security feature. No credentials are required on the target. Refer to the Microsoft Security Update Guide for exploitation prerequisites and vendor-confirmed technical details.

Detection Methods for CVE-2026-62801

Indicators of Compromise

PowerShell command lines or script content containing traversal sequences such as ..\, ..%2f, or mixed separators targeting paths outside expected working directories.
Execution of .ps1 or .psm1 files sourced from network shares, downloads, or email attachments immediately preceding suspicious file access outside user directories.
PowerShell process writes or reads to sensitive locations (for example, C:\Windows\System32\, %ProgramData%\) inconsistent with normal administrative activity.

Detection Strategies

Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging to capture path arguments used by cmdlets such as Get-Content, Set-Content, Copy-Item, and Import-Module.
Alert on PowerShell child processes launched from Office applications, mail clients, or browsers, correlated with file activity outside user profiles.
Baseline expected PowerShell file access paths per host role and flag deviations that include traversal patterns.

Monitoring Recommendations

Forward PowerShell operational and Microsoft-Windows-PowerShell/Operational logs to a centralized analytics platform for rule-based and behavioral analysis.
Monitor Sysmon Event IDs 1 (process create) and 11 (file create) for PowerShell processes writing to protected directories.
Review outbound network connections from powershell.exe and pwsh.exe that precede local file operations, indicating remote payload delivery.

How to Mitigate CVE-2026-62801

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide on all systems running Windows PowerShell.
Restrict PowerShell execution to signed scripts using AllSigned or RemoteSigned execution policy where operationally feasible.
Block delivery of PowerShell scripts and archives from untrusted external sources at email and web gateways.

Patch Information

Microsoft addressed the vulnerability in the security update published on September 8, 2026. Administrators should consult the Microsoft Security Update Guide for the specific KB articles and build numbers that apply to each supported Windows and PowerShell version.

Workarounds

Enforce Windows Defender Application Control (WDAC) or AppLocker rules that limit which PowerShell scripts and modules can execute.
Enable Constrained Language Mode for PowerShell sessions handling untrusted input to reduce the available attack surface.
Educate users to avoid running PowerShell scripts or opening PowerShell-associated files received from untrusted senders.

bash

# Configuration example: enforce signed scripts and enable logging
Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy AllSigned
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging' -Name EnableModuleLogging -Value 1