CVE-2026-70338 Microsoft CVE debrief

Who should care

Defenders and administrators responsible for PowerShell installations should assess exposure and apply patches. This vulnerability requires local access to exploit.

Why it matters

CVE-2026-70338 allows local attackers to bypass security features in PowerShell. Defenders should prioritize patching affected versions and monitor for suspicious activity.

• Local attackers can inject code to bypass security features
• Affected versions require immediate patching
• Inventory and monitoring are crucial for detection

Technical summary

The vulnerability allows an unauthorized attacker to bypass a security feature locally in Microsoft PowerShell. Affected versions include PowerShell 7.4.0 to 7.4.18.0, 7.5.0 to 7.5.9.0, and 7.6.0 to 7.6.4. Microsoft has released patches for these versions.

Defensive priority

High

Recommended defensive actions

• Review and apply Microsoft patches for affected PowerShell versions
• Inventory PowerShell installations to identify exposure
• Monitor for suspicious local activity

Evidence notes

The CVE record and Microsoft's advisory provide details on the vulnerability and affected versions. However, no additional information on exploitation or impact was found.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.