CVE-2026-70338 is a high severity (CVSS 7.8) code injection flaw in Microsoft PowerShell. A local attacker who gets a user to take an action can bypass a security feature. The fix is the security update listed in the Microsoft Security Response Center entry for your PowerShell build.
What's affected
The record names Microsoft PowerShell and gives no version list. It describes improper control of generation of code, tracked as CWE-94, which lets an unauthorized attacker bypass a security feature locally.
The CVSS vector is AV:L/AC:L/PR:N/UI:R, which reads as local access, low complexity, no privileges, and a user who must do something. Confidentiality, integrity and availability impacts are all rated high.
I could not confirm affected or fixed builds from the MSRC page, so check it directly. Windows PowerShell 5.1 ships with Windows and is patched through Windows updates. PowerShell 7 is a separate install with its own release channel, so confirm which of the two you run before deciding where the fix comes from.
How to check if you're exposed
The record does not list version numbers, and the Microsoft Security Response Center page is rendered by script, so I could not read the affected build table. Use the MSRC entry for this CVE as the source of truth for your exact build.
Start with an inventory of what you actually run. Patch state is the question, so ask each machine which updates it has installed:
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10
Compare the newest entries with the update the MSRC page names for your product and version. For managed fleets, use the compliance view in Windows Update for Business, WSUS or Configuration Manager rather than checking hosts by hand.
For software that ships inside other products, a plain host check can miss it. free in-browser dependency scan reads a manifest or lockfile in your browser and lists known vulnerabilities by component, which helps when the affected package is bundled with an application you build.
To see which PowerShell you are on:
$PSVersionTable.PSVersion
$PSVersionTable.PSEdition
Desktop means Windows PowerShell 5.1. Core means PowerShell 7 or later.
What to do now
- Open the MSRC entry for CVE-2026-70338 and note the fixed builds for your PowerShell edition.
- Run the version commands above on a sample of hosts to find where each edition is installed.
- Deploy the update through your normal patch channel, starting with admin workstations and jump hosts.
- Review PowerShell language mode and script block logging so that a bypass of a security feature is visible in your logs.
- Record the patched state in your asset inventory and re-check after the next patch cycle.
Why it matters
CWE-94 is code injection: data that should be treated as text ends up interpreted as code. In a shell that exists to run code, the harm is not that code runs. The harm is that a protection meant to limit which code runs can be sidestepped.
The score is high rather than critical because exploitation is local and needs a user to act. That still matters on shared workstations and in phishing chains, where local code execution controls are often the last barrier. The record does not mark this CVE as known exploited.
Quick check
Is CVE-2026-70338 exploited in the wild?
The record does not flag it as listed in the CISA Known Exploited Vulnerabilities catalog, and I did not find an advisory that says it is exploited. Check the MSRC page for any change.
Sources
Last reviewed: 18 October 2026.
