On July 15, 2026, Trend Micro's Zero Day Initiative published advisory ZDI-26-414, documenting a directory traversal vulnerability in the parsing of Microsoft PowerShell module help files. The flaw enables arbitrary remote code execution with required user interaction. Microsoft assigned CVE-2026-40400 and released an official update. The combination of an apparently innocuous vector — module documentation — with the impact of full system compromise makes this case paradigmatic of the hidden risks in everyday system administrator workflows.
- ZDI-26-414 identifies directory traversal in PowerShell help file parsing, with RCE in the context of the current user.
- User interaction is required: the victim must visit a malicious page or open a malicious file.
- Microsoft assigned CVE-2026-40400, severity "Important", CVSS 3.1 vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.
- Microsoft's exploitability assessment is "Exploitation Unlikely" with "Publicly disclosed: No" and "Exploited: No".
The Mechanism: How a Help File Becomes an RCE Vector
The vulnerability resides in the parsing of PowerShell module help files. According to the ZDI advisory, "the specific flaw exists within the parsing of PowerShell module help files. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations."
This missing validation enables directory traversal: the attacker controls the help file load path, bypassing intended filesystem boundaries. The result is arbitrary code execution in the context of the user who launched PowerShell. The ZDI advisory is explicit: "this vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft PowerShell."
The vector requires human interaction. The victim must visit a malicious web page or open a malicious file: the CVSS 3.1 reports UI:R (User Interaction: Required). Microsoft confirms: "this attack requires an authenticated client to click a link so that an unauthenticated attacker can initiate remote code execution." The chain is therefore spear-phishing or social engineering, not an automatic wormable exploit.
Microsoft's Classification and the Risk of Underestimation
Microsoft assigned CVE-2026-40400 with maximum severity "Important." The full CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C. The metrics indicate: network vector, low attack complexity, low privileges required, high impact on confidentiality, integrity, and availability. The remediation level "O" (Official fix) confirms a patch is available.
The data point creating interpretive tension is the exploitability assessment "Exploitation Unlikely," accompanied by "Publicly disclosed: No" and "Exploited: No." This can lead to classifying the vulnerability as low priority. However, the combination of AC:L (low complexity) with the profile of the typical victim — system administrators who use PowerShell daily and are accustomed to consulting module documentation — creates a relevant enterprise attack surface.
The numerical CVSS base score is not explicit in the provided sources: only the vector string is available. The specific affected PowerShell versions are not detailed. The exact path of the vulnerable help file or the specific format is not reported in the dossier.
"Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network." — Microsoft MSRC, CVE-2026-40400
Who Is in the Crosshairs and Why the Victim Profile Matters
PowerShell is the pervasive automation, configuration, and management tool in Windows enterprise, Azure cloud, and hybrid infrastructures. System administrators represent the natural target: they use Get-Help and module documentation files as part of their daily operational workflow. This familiarity is precisely what makes the vector insidious.
An attacker who compromises a system administrator's account via this mechanism gains access to that user's execution context — typically elevated in enterprise environments. The ZDI advisory notes the attacker executes code "in the context of the current user," without specifying whether further privilege escalation steps are required. The dossier does not document temporary workarounds beyond the official patch.
What to Do Now
Apply the update released by Microsoft for CVE-2026-40400, verifying that the remediation level "O" in the CVSS indicates an official fix is available. Monitor asset inventory to identify PowerShell installations in enterprise and cloud environments. Assess the exposure surface of administrative accounts that use PowerShell interactively, considering that the required user interaction makes the vector dependent on spear-phishing. Review segmentation policies to limit the impact of a potential compromise in the context of a single administrative user.
The exact release date of the Microsoft patch is not captured in the provided source text, although the RL:O field confirms official availability. It is not known whether alternative countermeasures to the patch exist: the dossier does not specify additional remedial measures.
Why This Case Signals a Broader Pattern
The vulnerability ZDI-26-414 / CVE-2026-40400 falls into a category of flaws often underestimated: auxiliary functionality — help, documentation, configuration file parsing — treated as an internal trust boundary. Help file parsing is not typically subjected to the same security scrutiny as the core execution engine. This case demonstrates that the attack perimeter extends to any parsing path that accepts user-controllable input.
The discovery occurred on May 28, 2026, according to the ZDI timeline, with coordinated public disclosure on July 15, 2026: a cycle of approximately seven weeks between report and publication, consistent with standard vendor coordination. It is not known whether the vulnerability was discovered internally by ZDI or by an external researcher: the advisory's credit field is empty in the provided sources.
The absence of documented infrastructure overlaps with known threat actor campaigns, combined with Microsoft's "Exploited: No" status, does not preclude the vector being adopted in the future. The low attack complexity and high value of potential victims keep the risk in elevated enterprise priority classes, regardless of the current exploitability assessment.
Frequently Asked Questions
Is an administrative account required to exploit the vulnerability?
No. The CVSS reports PR:L (Privilege Required: Low), and Microsoft specifies "an unauthenticated attacker can initiate remote code execution" via a link that an authenticated client clicks. The attacker does not need credentials, but the victim does.
Is the patch mandatory even with "Exploitation Unlikely"?
Microsoft classifies severity as "Important" with impact C:H/I:H/A:H. The exploitability assessment reflects current state, not a future guarantee. The dossier does not document alternatives to the patch.
Is PowerShell Core affected or only Windows PowerShell?
The dossier does not distinguish between PowerShell Core and Windows PowerShell: the specific affected versions are not detailed in the provided sources.
Information has been verified against cited sources and is current as of publication.
Sources
- http://www.zerodayinitiative.com/advisories/ZDI-26-414/
- https://www.zerodayinitiative.com/advisories/published/
- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-40400