CVE-2026-26143
Published: 14 April 2026
Summary
CVE-2026-26143 is a high-severity Improper Input Validation (CWE-20) vulnerability in Microsoft Powershell. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique PowerShell (T1059.001); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26143 is an improper input validation vulnerability (CWE-20) in Microsoft PowerShell that enables an unauthorized attacker to bypass a security feature locally. Published on 2026-04-14, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact.
An attacker with local access to the system can exploit this vulnerability with low complexity and no required privileges, though user interaction is necessary. Successful exploitation allows the attacker to achieve high levels of confidentiality, integrity, and availability impacts, effectively bypassing PowerShell's security controls.
The Microsoft Security Response Center provides details on mitigation and patches in its update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26143.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22369
Vulnerability details
Improper input validation in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an improper input validation flaw in PowerShell that directly bypasses its built-in security controls (e.g., execution policy, AMSI, constrained language mode). This enables an attacker to run arbitrary PowerShell commands/scripts locally that would otherwise be blocked, mapping directly to the PowerShell command-and-scripting-interpreter technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the improper input validation (CWE-20) vulnerability by requiring validation mechanisms at PowerShell input points to prevent bypass of security features.
Ensures timely identification, reporting, and patching of the specific PowerShell flaw referenced in the MSRC update guide, preventing exploitation.
Establishes secure configuration settings for PowerShell, such as execution policies or constrained language mode, to mitigate local bypass risks until fully patched.