CVE-2026-85817

Executive Summary

CVE-2026-85817 is a vulnerability in Microsoft Windows PowerShell arising from reliance on untrusted inputs in a security decision (CWE-807), which allows an unauthorized, network-positioned attacker to achieve code execution. Exploitation requires user interaction (CVSS UI:R), meaning a victim must take an action such as opening a crafted file, following a link, or executing a supplied script. With a CVSS base score of 8.8 (High severity) and full impact to confidentiality, integrity, and availability, successful exploitation would grant the attacker code execution in the security context of the affected user.

Technical Analysis

The vulnerability is classified under CWE-807: "Reliance on Untrusted Inputs in a Security Decision." This weakness class occurs when an application makes a security-relevant decision — for example, whether to execute code, trust a resource, or grant a privilege — based on data that originates from an untrusted or attacker-controllable source. Because the decision input can be influenced by the attacker, the security control can be bypassed or subverted, causing the application to perform actions it should not.

In the context described, the vulnerable component is Windows PowerShell, Microsoft's command-line shell and scripting environment. The NVD description states that the flaw "allows an unauthorized attacker to execute code over a network." Combined with the CWE-807 classification, the mechanism is a trust-decision failure: PowerShell (or a component within the PowerShell execution path) evaluates attacker-influenced input when deciding whether something is safe or authorized, and the wrong decision permits the attacker's code to run. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates the attacker is unauthenticated (PR:N), the attack is network-delivered (AV:N), no special conditions are required (AC:L), and the victim must be induced to act (UI:R).

Technical detail limitation: The CNA title field is empty and the NVD description is a single high-level sentence. Tracked sources provide no affected version ranges, no OSV package data, and no patch evidence. Specific function names, cmdlets, parameter names, script paths, or execution entry points are NOT available in the supplied data and are deliberately not fabricated here. Any claim naming a specific PowerShell feature (e.g., a particular execution-policy check, module-loading routine, or serialization/deserialization path) would be speculation and is therefore excluded. The report describes the vulnerability strictly at the class and mechanism level.

The distinguishing characteristic of a CWE-807 flaw is that it is not memory corruption and not a classic injection sink; it is a logic/trust defect. The attacker does not necessarily need to overflow a buffer or escape a sandbox — they need to control the input that PowerShell consults when a security decision is made, then cause the decision to resolve in their favor.

Exploitation Scenarios

Because no public PoC, Nuclei template, or exploit code is available, the attack chain below is inferred at the vulnerability-class level (CWE-807, untrusted-input security decision) and does not assert specific implementation details.

1. Reconnaissance / target identification. The attacker identifies hosts running Windows PowerShell that meet the delivery conditions. Relevant exposure includes network-reachable PowerShell management services (the Shodan dorks port:5985 and port:5986 reference the standard PowerShell Remoting HTTP/HTTPS listener ports) and users who can be induced to open content that PowerShell will process. The attacker profiles the environment to find a viable delivery vector.

2. Triggering the flawed security decision. The attacker delivers input that PowerShell consumes while making a security-relevant decision. Per CWE-807, the attacker-influenced input is what the security check relies upon. The CVSS UI:R metric means the attacker must persuade the victim to perform an action — for example, opening a file, following a link, or running supplied content — that causes the vulnerable PowerShell component to evaluate the attacker's input in its decision logic. The attacker does not require credentials (PR:N) or elevated preconditions (AC:L).

3. Code execution. Because the security decision resolves incorrectly, PowerShell proceeds to execute code that should have been blocked, denied, or treated as untrusted. Execution occurs in the context of the victim user (scope unchanged, S:U). At this stage the vulnerability's impact — arbitrary code execution over the network — is realized.

4. Post-exploitation impact. With code execution as the victim user, the attacker achieves high confidentiality, integrity, and availability impact: reading sensitive data, modifying or destroying data, and disrupting availability. Typical follow-on activity fitting the network-execution pattern includes establishing persistence, harvesting credentials accessible to the user context, and using the host as a foothold for lateral movement.

No public exploit material exists for this CVE at the time of writing; reconnaissance-to-exploitation timing cannot be estimated from the supplied data.

Impact Assessment

The CVSS v3.1 base score is 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Subscore interpretation:

• Attack Vector (Network): exploitable remotely; the attacker does not require local access to the target.
• Attack Complexity (Low): no specialized conditions or race window are needed.
• Privileges Required (None): the attacker does not need to authenticate.
• User Interaction (Required): a victim must be induced to act — this is the primary friction in the attack chain and the main reason the score is 8.8 rather than critical.
• Scope (Unchanged): exploitation stays within the same authorization scope/security authority.
• Confidentiality / Integrity / Availability (all High): full compromise of data secrecy, data trustworthiness, and system availability within the affected context.

Business impact: Successful exploitation yields unauthorized code execution on affected Windows endpoints and servers in the user's context — enabling data theft, tampering, ransomware staging, credential access, and lateral movement. Because PowerShell is ubiquitous across Windows environments and is a well-known post-exploitation toolchain, a working exploit for this class of flaw could function as an initial-access or execution primitive in a larger intrusion.

Blast radius: Any Windows system exposing the vulnerable PowerShell component and reachable by a delivery path is potentially affected. Multi-user and internet-adjacent hosts present the broadest risk surface. Enterprise environments with centralized endpoint management should assume the entire Windows fleet is in scope pending version confirmation.

Exploitation likelihood: No EPSS score is available (not yet scored by FIRST.org). No CISA KEV entry exists and no exploit code is public, so current in-the-wild activity is not indicated by available data. However, the low attack complexity and lack of privilege requirements make weaponization plausible once technical details are released.

Detection Guidance

Sigma Rule

title: Suspicious Windows PowerShell Execution Following Untrusted Input Decision Bypass (CVE-2026-85817)
id: 7b3c1e94-2f56-4a01-9c8d-4d21cve85817
status: experimental
description: Detects PowerShell process executions with network-sourced command paths or suspicious invocation patterns consistent with exploitation of CWE-807 in Windows PowerShell. High-level heuristic rule; tune to environment.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85817
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - '\powershell.exe'
        - '\pwsh.exe'
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\outlook.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\browser.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\edge.exe'
  selection_flags:
    CommandLine|contains:
      - '-EncodedCommand'
      - '-enc '
      - '-nop'
      - '-w hidden'
      - '-WindowStyle Hidden'
      - 'FromBase64String'
      - 'IEX'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'DownloadFile'
  condition: selection_img and selection_parent and selection_flags
falsepositives:
  - Legitimate administrative scripts launched from office or browser contexts (rare; validate)
  - Software installation and management frameworks
level: high
tags:
  - attack.execution
  - attack.t1204
  - attack.t1059.001

YARA Rule

rule CVE_2026_85817_PowerShell_Untrusted_Input_Execution
{
    meta:
        description = "Detects PowerShell script content exhibiting untrusted-input execution patterns and obfuscated invocation consistent with CWE-807 abuse in Windows PowerShell (CVE-2026-85817)."
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85817"
        severity = "high"
        cve = "CVE-2026-85817"

    strings:
        $ps1 = "PowerShell" ascii wide nocase
        $inv1 = "Invoke-Expression" ascii wide nocase
        $inv2 = "IEX " ascii wide nocase
        $enc1 = "FromBase64String" ascii wide nocase
        $enc2 = "-EncodedCommand" ascii wide nocase
        $dl1 = "DownloadString" ascii wide nocase
        $dl2 = "DownloadFile" ascii wide nocase
        $dl3 = "Invoke-WebRequest" ascii wide nocase
        $exec = "Start-Process" ascii wide nocase
        $bypass = "ExecutionPolicy Bypass" ascii wide nocase
        $hidden = "-WindowStyle Hidden" ascii wide nocase

    condition:
        $ps1 and 2 of ($inv*, $enc*, $dl*) and 1 of ($exec, $bypass, $hidden)
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-85817 Windows PowerShell Untrusted Input Execution - Suspicious Script Retrieval"; flow:established,to_server; http.method; content:"GET"; http.uri; content:".ps1"; nocase; http.user_agent; content:"PowerShell"; nocase; threshold:type limit, track by_src, count 1, seconds 60; classtype:attempted-user; reference:cve,CVE-2026-85817; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85817; sid:8581701; rev:1;)

alert tcp $HOME_NET any -> $EXTERNAL_NET 80,443,8080,8443 (msg:"CVE-2026-85817 PowerShell Remote Payload Download Detected"; flow:established,to_server; content:"Mozilla"; negate; content:"PowerShell"; nocase; content:"|2e 70 73 31|"; nocase; threshold:type limit, track by_src, count 3, seconds 120; classtype:attempted-user; reference:cve,CVE-2026-85817; sid:8581702; rev:1;)

Elastic Detection

process where host.os.type == "windows" and event.type == "start" and
  process.name : ("powershell.exe", "pwsh.exe") and
  process.parent.name : ("winword.exe", "excel.exe", "outlook.exe", "wscript.exe",
                         "cscript.exe", "mshta.exe", "chrome.exe", "msedge.exe",
                         "firefox.exe") and
  process.command_line : ("*-EncodedCommand*", "*-enc *", "*-nop*",
                          "*-WindowStyle Hidden*", "*ExecutionPolicy Bypass*",
                          "*FromBase64String*", "*Invoke-Expression*", "*IEX *",
                          "*DownloadString*", "*DownloadFile*")

Splunk SPL Query

index=windows (sourcetype="WinEventLog:Security" EventCode=4688 OR sourcetype="WinEventLog:Sysmon" EventCode=1)
| eval proc=coalesce(New_Process_Name, Image), cmd=coalesce(Process_Command_Line, CommandLine), parent=coalesce(Parent_Process_Name, ParentImage)
| where (like(proc,"%powershell.exe") OR like(proc,"%pwsh.exe"))
| where (like(parent,"%winword.exe") OR like(parent,"%excel.exe") OR like(parent,"%outlook.exe") OR like(parent,"%wscript.exe") OR like(parent,"%cscript.exe") OR like(parent,"%mshta.exe") OR like(parent,"%chrome.exe") OR like(parent,"%msedge.exe") OR like(parent,"%firefox.exe"))
| where (like(cmd,"%-EncodedCommand%") OR like(cmd,"%-enc %") OR like(cmd,"%ExecutionPolicy Bypass%") OR like(cmd,"%FromBase64String%") OR like(cmd,"%Invoke-Expression%") OR like(cmd,"%IEX %") OR like(cmd,"%DownloadString%") OR like(cmd,"%-WindowStyle Hidden%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(cmd) as commands by host, parent, proc
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="windows,powershell,cve-2026-85817,">
  <rule id="858170" level="12">
    <if_sid>61603</if_sid>
    <field name="win.eventdata.image">powershell.exe|pwsh.exe</field>
    <field name="win.eventdata.commandLine">(?i)(-EncodedCommand|-enc |ExecutionPolicy Bypass|FromBase64String|Invoke-Expression|IEX |DownloadString|DownloadFile|-WindowStyle Hidden)</field>
    <description>CVE-2026-85817: Suspicious PowerShell invocation consistent with untrusted-input execution decision bypass</description>
    <mitre>
      <id>T1204</id>
      <id>T1059.001</id>
    </mitre>
    <group>cve_2026_85817,</group>
  </rule>

  <rule id="858171" level="13">
    <if_sid>858170</if_sid>
    <field name="win.eventdata.parentImage">(?i)(winword|excel|outlook|wscript|cscript|mshta|chrome|msedge|firefox)\.exe</field>
    <description>CVE-2026-85817: Office/browser process spawned suspicious PowerShell - potential exploitation of CVE-2026-85817</description>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cve_2026_85817,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch, vendor fix, or workaround is documented by any tracked source (Patch Sources: none; Vendor Fix: N/A; Workarounds: N/A). Affected version ranges are not published. The guidance below is a defensive baseline appropriate to the vulnerability class and must be reconciled against a Microsoft advisory once one is available.

1) Immediate mitigations

• Enforce PowerShell Constrained Language Mode and AppLocker/WDAC script rules to restrict which scripts and modules may execute, reducing the attacker's ability to abuse PowerShell for code execution.
• Enable PowerShell script block logging, module logging, and transcription to capture execution content for detection.
• Harden the PowerShell execution policy at the machine level and block execution of unattended script content where not required.
• Restrict outbound network access from endpoints so that any network-retrieved payload cannot reach additional infrastructure.
• Disable or tightly firewall PowerShell Remoting (default TCP 5985/5986) where not operationally required; where required, restrict to trusted management subnets.
• Apply email/web filtering to block delivery of script content and reduce the user-interaction vector (UI:R).

2) Patch / upgrade steps

• Monitor the Microsoft Security Update Guide and Microsoft advisories for a fix referencing CVE-2026-85817. No patch is currently available.
• When a patch is released, identify all exposed Windows systems, test in a staging ring, and deploy on an accelerated schedule given the High severity and low attack complexity.
• Confirm affected product and version applicability using the vendor advisory before deployment; current data does not define version ranges.

3) Long-term hardening

• Implement application allow-listing (WDAC/AppLocker) and least-privilege endpoint configuration to constrain post-exploitation code execution.
• Adopt centralized, tamper-evident PowerShell logging shipped to the SIEM with alerting tuned to the detection rules above.
• Reduce exposure of PowerShell Remoting endpoints to untrusted networks and enforce network segmentation.
• Maintain an asset inventory of PowerShell-enabled hosts and services so detection coverage and future patching are complete.

References

• NVD — CVE-2026-85817: https://nvd.nist.gov/vuln/detail/CVE-2026-85817
• MITRE CWE-807 — Reliance on Untrusted Inputs in a Security Decision: https://cwe.mitre.org/data/definitions/807.html
• FIRST EPSS: no score available for CVE-2026-85817 at time of writing
• CISA Known Exploited Vulnerabilities Catalog: CVE-2026-85817 not listed
• Microsoft Security Update Guide (monitor for vendor advisory): https://msrc.microsoft.com/update-guide

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-85817 in the supplied data. No public PoC or exploit code exists at the time of writing.