CVE-2026-70338: Microsoft PowerShell Auth Bypass Flaw

CVE-2026-70338 Overview

CVE-2026-70338 is a code injection vulnerability in Microsoft PowerShell. The flaw stems from improper control of code generation, classified as [CWE-94]. An unauthorized attacker can leverage this weakness to bypass a security feature locally on an affected system.

Exploitation requires local access and user interaction, but no prior privileges. Successful attacks compromise confidentiality, integrity, and availability. Microsoft published the advisory on August 11, 2026, and it was last updated the following day.

Critical Impact
An attacker with local access can inject code into PowerShell to bypass a security control, achieving high impact across confidentiality, integrity, and availability.

Affected Products

Microsoft PowerShell (see the Microsoft Security Update CVE-2026-70338 advisory for specific version details)

Discovery Timeline

2026-08-11 - CVE-2026-70338 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-70338

Vulnerability Analysis

CVE-2026-70338 is a code injection weakness in Microsoft PowerShell. PowerShell fails to properly control how code is generated from untrusted input, allowing attacker-controlled content to be parsed and executed as part of a legitimate PowerShell operation.

The vulnerability enables an attacker to bypass a PowerShell security feature. Because PowerShell is used to enforce policy boundaries such as script execution controls and Constrained Language Mode, a bypass in code generation undermines defenses relied upon by administrators and endpoint protection tooling.

Exploitation requires the attacker to deliver crafted input that a local user opens or executes. The attack chain results in high impact to confidentiality, integrity, and availability because injected code inherits the trust context of the current PowerShell session.

Root Cause

The root cause is improper control of generation of code, categorized under [CWE-94]. PowerShell constructs executable statements from input without sufficient validation or neutralization. Attacker-supplied content escapes the intended data context and is treated as executable code.

Attack Vector

The attack vector is local and requires user interaction. An attacker crafts a malicious script, module, configuration, or input file. When the victim invokes PowerShell against the malicious content, the injected code executes in the user's session and bypasses the security feature that would normally block or constrain the operation.

See the Microsoft Security Update CVE-2026-70338 advisory for further technical detail. No public proof-of-concept or in-the-wild exploitation has been reported at the time of publication.

Detection Methods for CVE-2026-70338

Indicators of Compromise

PowerShell child processes spawned from unusual parents such as Office applications, browsers, or archive utilities.
Script block logging entries containing obfuscated content, encoded commands, or Invoke-Expression chains that decode strings at runtime.
Unexpected loading of PowerShell modules from user-writable paths.
New scheduled tasks, services, or startup entries created immediately after PowerShell execution.

Detection Strategies

Enable PowerShell Script Block Logging (EventID 4104) and Module Logging to capture the actual code executed after de-obfuscation.
Enable PowerShell Transcription to record session input and output to a protected write-only share.
Hunt for constructs commonly used to bypass execution policy such as -ExecutionPolicy Bypass, -EncodedCommand, and dynamic Add-Type compilation.

Monitoring Recommendations

Forward PowerShell operational and script block logs to a centralized SIEM for correlation with process creation events (EventID 4688 or Sysmon EventID 1).
Alert on PowerShell invocations that load unsigned scripts from temporary directories or user profile paths.
Baseline normal PowerShell usage per host role so anomalous scripting activity on servers and workstations surfaces quickly.

How to Mitigate CVE-2026-70338

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update CVE-2026-70338 advisory across all Windows endpoints and servers.
Inventory hosts running PowerShell and prioritize patch deployment on systems that execute scripts from external sources.
Restrict local user rights to prevent low-trust accounts from executing unvetted PowerShell content.

Patch Information

Microsoft has issued a security update addressing CVE-2026-70338. Refer to the Microsoft Security Update CVE-2026-70338 advisory for build numbers, affected versions, and installation guidance. Apply updates through Windows Update, WSUS, or your enterprise patch management platform.

Workarounds

Enforce PowerShell Constrained Language Mode for non-administrative users through Windows Defender Application Control or AppLocker policies.
Require signed scripts by setting the execution policy to AllSigned where operationally feasible.
Remove or disable Windows PowerShell 2.0 engine, which lacks modern logging and safety controls.
Restrict PowerShell remoting endpoints to administrative accounts and monitored jump hosts.

bash

# Configuration example: enforce signed scripts and enable script block logging
Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy AllSigned

# Enable Script Block Logging via registry
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -Value 1

# Disable legacy PowerShell v2 engine
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2 -NoRestart
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root -NoRestart