PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-70337 Microsoft CVE debrief

Microsoft PowerShell Remote Code Execution Vulnerability allows an unauthorized attacker to execute code over a network due to a relative path traversal in Microsoft PowerShell Core. This vulnerability impacts PowerShell deployments, particularly those using PowerShell 7.4, 7.5, and 7.6. Defenders should assess exposure and apply patches to mitigate potential operational impacts, including verifying exposure, applying vendor patches, and monitoring for suspicious activity in PowerShell usage.

Vendor
Microsoft
Product
PowerShell 7.4
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-11
Original CVE updated
2026-10-08
Advisory published
2026-08-11
Advisory updated
2026-10-08

Who should care

Defenders responsible for PowerShell deployments, particularly those using PowerShell 7.4, 7.5, and 7.6, should assess exposure and apply patches.

Why it matters

CVE-2026-70337 allows unauthorized code execution over a network, impacting PowerShell 7.4, 7.5, and 7.6 deployments. Defenders should verify exposure and apply patches.

  • Verify exposure in PowerShell deployments
  • Apply patches for affected versions
  • Monitor for suspicious activity

Technical summary

A relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network. This vulnerability affects PowerShell 7.4, 7.5, and 7.6 deployments. Defenders should prioritize verifying exposure in these deployments and applying vendor patches to mitigate potential operational impacts. The vulnerability does not require authentication or user interaction, making it a high-severity issue for PowerShell deployments.

Defensive priority

Defenders should prioritize verifying exposure in PowerShell 7.4, 7.5, and 7.6 deployments and applying vendor patches.

Recommended defensive actions

  • Verify exposure in PowerShell 7.4, 7.5, and 7.6 deployments
  • Apply vendor patches for affected versions
  • Monitor for suspicious activity in PowerShell usage

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on exploitation or victim impact. Defenders should verify exposure in PowerShell 7.4, 7.5, and 7.6 deployments and apply vendor patches. The vulnerability allows unauthorized code execution over a network, impacting PowerShell deployments. There is no evidence of exploitation in the wild, but defenders should monitor for suspicious activity in PowerShell usage.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-70337 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-70337

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-70337 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-70337

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Microsoft PowerShell Remote Code Execution Vulnerability

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/70xxx/CVE-2026-70337.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70337

    Supplemental source - vendor-advisory, patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.