CVE-2026-85805: Windows PowerShell Auth Bypass Vulnerability

CVE-2026-85805 Overview

CVE-2026-85805 is a security feature bypass vulnerability in Windows PowerShell. The flaw stems from an improperly implemented security check for a standard, enabling an unauthorized attacker to bypass a security control over a network. The vulnerability is categorized under [CWE-358] (Improperly Implemented Security Check for Standard).

Successful exploitation requires user interaction but no authentication. The attack vector is network-based, and the primary impact is on integrity. Microsoft published the advisory on 2026-10-13.

Critical Impact
An unauthorized remote attacker can bypass a PowerShell security feature by convincing a user to interact with crafted content, undermining the integrity assumptions of a trusted security control.

Affected Products

Windows PowerShell
See the Microsoft Vulnerability Advisory CVE-2026-85805 for the specific build and version matrix
Not Available (component-level CPE data not published at the time of writing)

Discovery Timeline

2026-10-13 - CVE CVE-2026-85805 published to NVD
2026-10-13 - Microsoft Security Response Center advisory released
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85805

Vulnerability Analysis

The vulnerability resides in a security check within Windows PowerShell that does not conform to the standard it is meant to enforce. Because the check is implemented incorrectly, an attacker can craft input or content that the check accepts as safe when it should be rejected.

The flaw affects integrity but not confidentiality or availability. An attacker who successfully exploits the issue can cause PowerShell to treat untrusted content as if it had passed the intended security boundary. Exploitation requires the target user to perform an action, such as opening a file, clicking a link, or executing a script delivered by the attacker.

Root Cause

The root cause is classified under [CWE-358]: Improperly Implemented Security Check for Standard. The PowerShell security control deviates from the specification it is intended to implement, leaving a gap that an attacker can leverage. Specific technical implementation details have not been published by Microsoft in the public advisory.

Attack Vector

The attacker delivers crafted content over a network channel such as email, a web download, a shared folder, or an internal application. The victim must open or execute the content for the flawed security check to be invoked. Once invoked, the check incorrectly validates the input, allowing the attacker to bypass the protection and tamper with trusted PowerShell behavior.

No verified proof-of-concept code or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-85805

Indicators of Compromise

PowerShell script executions originating from user download directories, email attachment paths, or temporary folders shortly after user interaction with external content.
Unexpected invocation of PowerShell with execution policy or language mode arguments that would normally be restricted by the bypassed security feature.
Child processes spawned by powershell.exe or pwsh.exe that deviate from historical baselines for the affected user or host.

Detection Strategies

Hunt for PowerShell command lines containing encoded commands, obfuscated strings, or references to remote URLs, correlated with recent user document opens.
Monitor PowerShell Script Block Logging (Event ID 4104) and Module Logging (Event ID 4103) for scripts that touch sensitive registry keys, scheduled tasks, or credential stores.
Correlate network downloads with subsequent powershell.exe process starts to identify likely delivery chains.

Monitoring Recommendations

Enable PowerShell Script Block Logging, Module Logging, and Transcription across managed endpoints and forward logs to a central analytics platform.
Alert on PowerShell execution from Office applications, browsers, mail clients, and archive utilities.
Review Windows Defender Application Control and AppLocker events for policy evaluations tied to the affected security feature.

How to Mitigate CVE-2026-85805

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2026-85805 as soon as it is available for your builds.
Inventory systems running Windows PowerShell and prioritize patching for internet-facing hosts, administrator workstations, and servers hosting shared content.
Reinforce user awareness training on opening files and links from untrusted sources, since exploitation requires user interaction.

Patch Information

Microsoft published advisory CVE-2026-85805 on 2026-10-13 through the Microsoft Security Response Center. Consult the Microsoft Vulnerability Advisory CVE-2026-85805 for the authoritative list of affected builds, KB article numbers, and update packages. Apply updates through Windows Update, WSUS, Microsoft Update Catalog, or your standard patch management workflow.

Workarounds

Restrict PowerShell execution with Windows Defender Application Control or AppLocker policies that enforce signed-only scripts for standard users.
Set PowerShell to Constrained Language Mode for non-administrative users where operationally feasible.
Block or quarantine inbound .ps1, .psm1, and script-bearing archive attachments at the email gateway until patches are deployed.
Limit SMB and WebDAV access from user workstations to reduce network-based delivery paths.

bash

# Configuration example: enforce Constrained Language Mode via environment variable
# Deploy through Group Policy Preferences or an MDM configuration profile
setx __PSLockdownPolicy 4 /M