CVE-2026-70337: PowerShell Core Path Traversal Vulnerability

CVE-2026-70337 Overview

CVE-2026-70337 is a relative path traversal vulnerability [CWE-23] in Microsoft PowerShell Core. An unauthorized attacker can leverage the flaw to execute code over a network when a user interacts with attacker-controlled content. The vulnerability carries a CVSS 3.1 base score of 8.8 and affects the confidentiality, integrity, and availability of the target system.

Microsoft published the advisory on August 11, 2026. Exploitation requires user interaction, but no privileges are needed to launch the attack. Successful exploitation results in arbitrary code execution in the context of the invoking user.

Critical Impact
Successful exploitation permits remote code execution on hosts running vulnerable PowerShell Core builds, enabling initial access, lateral movement, and persistence across Windows, Linux, and macOS environments.

Affected Products

Microsoft PowerShell Core (cross-platform edition)
Applications and services embedding PowerShell Core runtime
Automation pipelines and CI/CD agents that execute PowerShell scripts sourced from remote locations

Discovery Timeline

2026-08-11 - Microsoft publishes the CVE-2026-70337 advisory
2026-08-11 - CVE-2026-70337 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-70337

Vulnerability Analysis

The vulnerability originates from improper validation of relative path elements inside PowerShell Core file handling routines. An attacker crafts input containing directory traversal sequences such as ..\ or ../ that escape the expected working directory. When PowerShell Core resolves the path, it references or loads files from unintended locations under attacker control.

Because PowerShell Core executes scripts and modules loaded from resolved paths, the traversal primitive escalates into code execution. The attack vector is network-based, meaning the malicious content can be delivered through remote sources like network shares, archives, or module repositories. Exploitation completes when the user opens or imports the crafted content.

The issue is classified under CWE-23: Relative Path Traversal. EPSS currently estimates a 0.775% probability of exploitation in the next 30 days.

Root Cause

PowerShell Core fails to canonicalize path inputs before resolving module or script locations. The sanitization logic does not strip or reject .. segments in relative paths supplied through remote or user-provided content. As a result, path resolution can traverse outside the intended base directory and reference attacker-staged executable content.

Attack Vector

An attacker hosts a malicious archive, module, or script package containing entries with relative path traversal sequences. The victim downloads or opens the content using PowerShell Core, for example by running Import-Module, Expand-Archive, or executing a script referencing external resources. During path resolution, PowerShell Core writes to or loads from an attacker-chosen directory, causing arbitrary code execution in the user context.

No authentication is required to stage the payload, and the complexity of the attack is low. The vulnerability requires the victim to interact with the malicious content. See the Microsoft CVE-2026-70337 Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-70337

Indicators of Compromise

Presence of files written outside the expected extraction or module directory following PowerShell operations
PowerShell process spawning unexpected child processes such as cmd.exe, bash, or scripting interpreters immediately after archive extraction or module import
Module or script files containing ..\ or ../ path segments in their manifest or archive entries
Outbound network connections from pwsh.exe or pwsh to untrusted hosts followed by file writes to system directories

Detection Strategies

Inspect archive contents and module manifests for entries containing traversal sequences before extraction or import
Correlate Import-Module, Expand-Archive, and script execution events with subsequent file writes to sensitive paths
Enable PowerShell script block logging (Event ID 4104) and module logging (Event ID 4103) to record suspicious cmdlet usage
Alert on pwsh processes creating executable files in user profile, startup, or system directories

Monitoring Recommendations

Ingest PowerShell operational logs into a centralized SIEM for behavioral correlation across endpoints
Baseline expected module import sources and alert on imports from unsigned or remote origins
Monitor for unusual parent-child process relationships originating from PowerShell Core
Track file system activity in module load paths defined by $env:PSModulePath

How to Mitigate CVE-2026-70337

Immediate Actions Required

Apply the security update referenced in the Microsoft CVE-2026-70337 Advisory to all systems running PowerShell Core
Inventory hosts, containers, and CI/CD agents with PowerShell Core installed and prioritize patching internet-exposed systems
Restrict execution of PowerShell scripts and modules obtained from untrusted network locations
Enforce PowerShell execution policies such as AllSigned or RemoteSigned where operationally feasible

Patch Information

Microsoft addressed the vulnerability in the PowerShell Core update documented in the vendor advisory. Administrators should consult the Microsoft CVE-2026-70337 Advisory for the fixed version numbers and download links applicable to each supported platform.

Workarounds

Avoid opening or importing PowerShell modules and archives from untrusted sources until patches are deployed
Run PowerShell Core in constrained language mode where scripting scope can be limited
Validate archive contents with tooling that rejects entries containing .. traversal sequences prior to extraction
Apply application allow-listing to prevent unsigned binaries from executing after PowerShell operations

bash

# Verify installed PowerShell Core version and update on Linux/macOS
pwsh -Command '$PSVersionTable.PSVersion'

# Example: enforce signed script execution in a session
pwsh -Command 'Set-ExecutionPolicy -Scope Process -ExecutionPolicy AllSigned'