CVE-2026-40400

What it actually does

CVE-2026-40400 is a relative path traversal vulnerability in Windows PowerShell. An authenticated attacker can cause PowerShell to resolve a file or command path outside the intended directory, potentially loading or executing attacker-controlled content from a network-accessible location. Because the CVSS vector requires low privileges and user interaction, exploitation likely depends on convincing a user or process to open, import, run, or otherwise resolve a crafted PowerShell-related path. Successful exploitation can result in code execution with the privileges of the affected user or process, with possible compromise of confidentiality, integrity, and availability.

Why it matters to the business

If exploited, this flaw could let an attacker who already has some access turn PowerShell into a code-execution path across the network. In business terms, that can enable workstation or server takeover, lateral movement, credential theft, data access, deployment of additional malware, and disruption of administrative systems. The issue affects many supported Windows client and server versions, including Windows 10, Windows 11, and Windows Server 2012 through 2025, so exposure may be broad in organizations with mixed Windows fleets. It is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, and has low EPSS at 0.00701 with no 30-day increase, but the CVSS 8.0 severity and PowerShell’s administrative importance make timely remediation important.

How an attack unfolds

An attacker first obtains valid low-privileged access or otherwise operates in a context where they can influence a PowerShell path, script, module, shortcut, network share, or workflow. They then craft a relative traversal sequence that causes PowerShell to resolve a resource outside the intended directory. The malicious payload may be placed on a reachable network share or embedded in a location reached through traversal. The attacker then induces required user interaction, such as getting a user to open or execute a crafted item, or triggering an administrative script or automation that resolves the attacker-controlled path. If the vulnerable PowerShell path handling is reached, PowerShell executes the attacker-controlled code. The attacker can then run commands under the victim user’s privileges, stage persistence, access data, collect credentials, or move laterally to other Windows systems.

How to fix it

Apply the relevant Microsoft security updates for all affected Windows versions as soon as they are available through Windows Update, Microsoft Update Catalog, WSUS, Intune, Configuration Manager, or other enterprise patching tools. Because no exact fixed versions were provided in the input, validate against Microsoft’s official advisory and patch metadata for Windows 10 1607, 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; and Windows Server 2012, 2016, 2019, 2022, and 2025. Where immediate patching is not possible, reduce exposure by restricting execution from untrusted network shares, enforcing PowerShell Constrained Language Mode where appropriate, enabling script block logging and module logging, requiring signed scripts for administrative workflows, limiting write access to shared script/module locations, disabling unnecessary legacy PowerShell components, and applying least privilege to users and automation accounts.

How to confirm the fix worked

Confirm remediation by verifying that all affected Windows endpoints and servers have the applicable Microsoft security update installed for their OS release. Use centralized patch compliance tooling, Windows Update history, installed hotfix inventory, and vulnerability scanning authenticated to the host. Validate that PowerShell execution policies, script-signing controls, logging, and network-share permissions are enforced as expected. To test exposure safely, review whether users or automation can execute PowerShell content from writable network shares or resolve relative paths containing traversal sequences; do not run untrusted proof-of-concept code in production. Confirm that PowerShell operational logs, Script Block Logging, Module Logging, process creation telemetry, and file share access logs are being collected for detection coverage.

Typical attack path

1. Gain low-privileged authenticated access or the ability to influence a PowerShell-related file, path, module, shortcut, script, or network location.
2. Create a crafted relative path using traversal sequences that escape the expected directory.
3. Host or place a malicious script, module, or executable content at the path reached after traversal, commonly on a network-accessible share.
4. Induce the required user interaction or wait for a user, administrator, or automation task to process the crafted PowerShell path.
5. Trigger PowerShell to resolve the crafted path and execute attacker-controlled code.
6. Use the resulting execution context to run commands, steal credentials or data, establish persistence, and move laterally.

How to detect it

Investigate whether the vulnerability has already been exploited by correlating PowerShell activity, process creation logs, file share access, and authentication events. Key log sources include Windows Security logs with process creation enabled, Sysmon process/file/network events, PowerShell Operational logs, Script Block Logging, Module Logging, PowerShell transcription logs, SMB file share audit logs, EDR telemetry, and Windows Defender or third-party AV alerts. Look for PowerShell launched with paths containing traversal sequences, PowerShell execution from UNC paths or writable shares, suspicious module imports from network locations, encoded or obfuscated PowerShell, and script execution shortly after a user opens a crafted file or shortcut. Also hunt for follow-on activity after suspicious PowerShell execution, including new scheduled tasks, new services, unexpected startup-folder writes, credential dumping tools, unusual outbound connections, remote admin tool use, and lateral SMB/WinRM activity. There are no public exploit-specific indicators provided, so detection should focus on behavioral evidence around PowerShell path traversal, network-hosted payloads, and post-exploitation actions.

• powershell.exe
• pwsh.exe
• ..\\
• ../
• \\\\
• -EncodedCommand
• -ExecutionPolicy Bypass
• Invoke-Expression
• IEX
• FromBase64String
• Import-Module
• Start-Process
• New-Object Net.WebClient
• DownloadString
• DownloadFile
• Event ID 4103
• Event ID 4104
• Event ID 4688
• Sysmon Event ID 1
• Sysmon Event ID 11
• Sysmon Event ID 22

What your security team should do

• Prioritize patching Windows systems that run administrative scripts, management tooling, automation jobs, jump-server functions, or file-share-hosted PowerShell content.
• Inventory Windows 10, Windows 11, and Windows Server versions listed as affected and track remediation through enterprise patch compliance reporting.
• Audit writable network shares that store scripts, modules, shortcuts, deployment packages, or administrative tooling, and remove unnecessary write access.
• Enable or verify PowerShell Script Block Logging, Module Logging, transcription where appropriate, and command-line process creation logging.
• Hunt for suspicious PowerShell execution involving relative traversal patterns, network paths, encoded commands, or execution from user-writable shares.
• Enforce least privilege for users, service accounts, and automation accounts that can run PowerShell against servers or administrative endpoints.
• Require signed scripts for privileged workflows and restrict execution from untrusted network locations.
• Monitor for post-exploitation behavior such as credential dumping, remote service creation, scheduled task creation, abnormal SMB access, and lateral movement.