CVE-2026-26170
Published: 14 April 2026
Summary
CVE-2026-26170 is a high-severity Improper Input Validation (CWE-20) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 24.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-26170 is an improper input validation vulnerability (CWE-20) in Microsoft PowerShell. Published on 2026-04-14T18:16:51.263, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact with relatively low barriers to exploitation.
The vulnerability enables a local authorized attacker possessing low privileges to exploit improper input validation in PowerShell. Exploitation requires local access and low attack complexity with no user interaction, allowing the attacker to elevate privileges and achieve high confidentiality, integrity, and availability impacts on the affected system.
Mitigation guidance is available in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26170.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22402
Vulnerability details
Improper input validation in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local improper input validation in PowerShell directly enables privilege escalation with high impact, mapping to T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates validation of all information inputs, addressing the core improper input validation flaw (CWE-20) in PowerShell that enables privilege escalation.
Requires timely identification, reporting, and correction of system flaws like this CVE through patching and updates as per Microsoft guidance.
Enforces least privilege to restrict low-privileged local attackers from achieving high-impact escalation even if the input validation vulnerability is exploited.