# CVE-2026-70185: Microsoft Windows PowerShell protection mechanism bypass

Source: https://junglewise.ai/threats/cve-2026-70185-protection-mechanism-failure-in-windows-powershell-allows-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-13. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-70185 · Severity: high · CVSS 8.8 · Published 2026-10-13

Windows PowerShell, a command-line shell used to automate system administration tasks, contains a flaw that allows an authorized attacker to bypass built-in security protections. An attacker with local access and valid credentials could circumvent security controls that prevent execution of unsigned or potentially malicious scripts, gaining the ability to run arbitrary code with elevated privileges.

Technologies: [Microsoft Windows PowerShell](https://junglewise.ai/threats/technologies/windows-powershell). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-70185 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-70185 being exploited in the wild.

**How severe is CVE-2026-70185?** High severity, with a CVSS score of 8.8, published 13 October 2026.

**Which products and versions are affected?** Microsoft Windows PowerShell.

**Is there a fix for CVE-2026-70185?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-70185 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-70185?** Check whether you run Microsoft Windows PowerShell. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A protection mechanism failure in Windows PowerShell allows authenticated local attackers to bypass security features, likely related to script execution policy enforcement or code signing validation. The vulnerability requires local access and existing authentication credentials. An attacker can exploit this to execute unsigned or untrusted code that would normally be blocked by PowerShell's execution policies.

## Affected products

- Microsoft Windows PowerShell

## Timeline

- 2026-10-13: disclosed

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70185](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70185)

## Related threats

- [Microsoft Windows PowerShell privilege escalation in execution](https://junglewise.ai/threats/cve-2026-124226-execution-with-unnecessary-privileges-in-windows-powershell)
- [Windows PowerShell code injection vulnerability](https://junglewise.ai/threats/cve-2026-124225-improper-control-of-generation-of-code-code-injection-in-windows)
- [Microsoft Windows PowerShell privilege escalation via symlink following](https://junglewise.ai/threats/cve-2026-124224-improper-link-resolution-before-file-access-link-following-in)
- [Windows PowerShell code injection security feature bypass](https://junglewise.ai/threats/cve-2026-113815-improper-control-of-generation-of-code-code-injection-in-windows)
- [Windows PowerShell untrusted input security decision remote code execution](https://junglewise.ai/threats/cve-2026-85817-reliance-on-untrusted-inputs-in-a-security-decision-in-windows)