CVE-2026-85817: Windows PowerShell RCE Vulnerability

CVE-2026-85817 Overview

CVE-2026-85817 is a remote code execution vulnerability in Windows PowerShell. The flaw stems from reliance on untrusted inputs in a security decision, cataloged under CWE-807. An unauthorized attacker can execute arbitrary code over a network when a user is convinced to interact with crafted content.

The vulnerability requires user interaction but no prior authentication. Successful exploitation compromises confidentiality, integrity, and availability on the affected host. Microsoft published the advisory through its security update guide.

Critical Impact

Attackers can achieve remote code execution on Windows systems running vulnerable PowerShell versions by tricking a user into processing attacker-controlled input that influences a trust decision.

Affected Products

• Windows PowerShell (specific affected versions listed in the Microsoft advisory)
• Windows operating systems bundling the affected PowerShell component
• Environments executing PowerShell scripts from network-reachable sources

Discovery Timeline

• 2026-10-13 - CVE CVE-2026-85817 published to NVD
• 2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-85817

Vulnerability Analysis

The weakness is classified as CWE-807: Reliance on Untrusted Inputs in a Security Decision. PowerShell evaluates attacker-influenced input when making a security-relevant choice, such as determining whether content should be treated as trusted or executed in a constrained context. When that input can be controlled by a remote actor, the decision logic can be subverted to permit code execution that would otherwise be blocked.

The attack is launched over the network and requires user interaction, which typically means opening a file, visiting a resource, or executing a script delivered through a phishing or watering-hole scenario. The scope remains unchanged, meaning the exploit executes within the security context of the invoking user.

Microsoft has not published exploitation details, and no public proof of concept is currently indexed. Refer to the Microsoft Vulnerability Guide CVE-2026-85817 for authoritative technical information.

Root Cause

The root cause is improper validation of input used in a security-relevant decision inside Windows PowerShell. Rather than deriving trust from an authoritative, tamper-resistant source, PowerShell uses data that an attacker can influence to decide how to handle execution. This weakness pattern commonly bypasses origin checks, zone identification, signature validation, or language-mode enforcement.

Attack Vector

The network attack vector combined with required user interaction aligns with scenarios where a user opens a crafted script, module, or document that is retrieved from a remote share, web location, or email attachment. Once PowerShell processes the input, the flawed security decision allows the attacker's code to run with the user's privileges.

No verified public exploit code is available. The vulnerability is described in prose only; see the Microsoft advisory for technical specifics as they are released.

Detection Methods for CVE-2026-85817

Indicators of Compromise

• PowerShell processes (powershell.exe, pwsh.exe) spawning from network-origin files such as those from WebDAV, SMB shares, or downloaded archives
• Unexpected child processes created by PowerShell, including cmd.exe, rundll32.exe, or script engines
• PowerShell execution of scripts bearing a Mark-of-the-Web (MOTW) alternate data stream (Zone.Identifier)
• Outbound network connections from PowerShell to uncategorized or newly observed domains

Detection Strategies

• Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging to capture obfuscated or dynamic script content
• Monitor Event ID 4688 process creation for PowerShell invoked with -EncodedCommand, -ExecutionPolicy Bypass, or -NoProfile
• Alert on PowerShell loading .psm1 or .ps1 files from UNC paths or user Download directories
• Correlate user interaction events, such as mail client or browser downloads, with subsequent PowerShell execution

Monitoring Recommendations

• Forward PowerShell operational and transcription logs to a centralized SIEM for retention and correlation
• Baseline normal PowerShell usage per host role and alert on deviations such as interactive shells on servers
• Track AMSI (Antimalware Scan Interface) scan results to identify scripts that attempt to evade inspection

How to Mitigate CVE-2026-85817

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft Vulnerability Guide CVE-2026-85817 across all Windows endpoints and servers
• Inventory systems running Windows PowerShell and prioritize patching for internet-facing and user-interactive hosts
• Restrict PowerShell execution on systems that do not require it through AppLocker or Windows Defender Application Control (WDAC)
• Enforce Constrained Language Mode where feasible to limit the surface available to untrusted scripts

Patch Information

Microsoft has released a security update addressing CVE-2026-85817. Administrators should consult the Microsoft Vulnerability Guide CVE-2026-85817 for the specific KB articles, affected builds, and update packages applicable to each supported Windows release. Deploy the update through Windows Update, WSUS, Microsoft Intune, or Configuration Manager according to standard change controls.

Workarounds

• Block execution of PowerShell scripts originating from the internet by enforcing a RemoteSigned or AllSigned execution policy via Group Policy
• Strip Mark-of-the-Web only after validating file provenance, and prevent users from unblocking downloaded scripts arbitrarily
• Disable Windows PowerShell v2 engine where still enabled, since legacy engines bypass several modern mitigations
• Apply application control policies to deny execution of unsigned scripts from user-writable directories

# Configuration example: enforce signed-script execution policy via PowerShell
Set-ExecutionPolicy -Scope LocalMachine -ExecutionPolicy AllSigned -Force

# Disable the legacy PowerShell v2 engine
Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root -NoRestart

# Enable Script Block Logging via registry
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name 'EnableScriptBlockLogging' -Value 1