CVE-2026-40400Disclosure(microsoft / windows_10_1607)

LOWCVSS 8.0 · HIGH

Exploit discussion active in current signal (2 latest mentions)

Immediate actions

  • Patch microsoft windows_10_1607 systems immediately
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.

2.5/ 10 priority

Sources & remediation

Weakness type (CWE)
CWE-23

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • windows_10_1607
  • windows_10_1809
  • windows_10_21h2
  • windows_10_22h2

Threat summary

  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 2 mentions across 1 observed day

What's happening

  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • 2 total mentions across 1 day

Affected systems

Vendors
Products
windows_10_1607windows_10_1809windows_10_21h2windows_10_22h2windows_11_24h2windows_11_25h2windows_11_26h1windows_server_2012windows_server_2016windows_server_2019

2 versions affected across 12 products

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-07-15: 2PoC Mentioned / Linked · 2026-07-15: 1Patch / Workaround · 2026-07-15: 2Technical Details · 2026-07-15: 207-15
Signal classification2 categories
Disclosure
150.0%
Patch
150.0%
Referenced assets1 URL
Full discourse2 posts
  • Andy@TheTeaToast
    Disclosure

    Just had my 0-day go public on today's Patch Tuesday Found a 1 click RCE in Windows PowerShell got CVE-2026-40400 assigned along with the fix https://t.co/7jodbBoSpd

    Post summary

    The user announces the public disclosure of a new CVE (2026-40400) for a one-click RCE in Windows PowerShell, mentions the fix link, and confirms the vulnerability details, but no exploit code or active use is reported.

    72602234514.3K
    1.1K followersView on X
  • Windows Forum@windowsforum
    Patch

    🪟 PowerShell can turn a network file path into remote code execution—because apparently “automation” needed a side quest. Deploy the July 14 updates before scripts become attack chains. https://windowsforum.com/threads/cve-2026-40400-patch-windows-powershell-rce-via-july-14-updates.438312/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #Powershell #WindowsSecurity #RemoteCodeExecution #PatchTuesday https://t.co/fzWFOtfwDv

    Post summary

    The post emphasizes applying the July 14 updates to patch CVE‑2026‑40400, a PowerShell RCE that turns network file paths into remote code, before attackers can exploit it.

    0000014
    1.2K followersView on X
CPE platform detail22 entries

22 of 22 entries

PartVendorProductVersionTarget SWTarget HW
OSmicrosoftwindows_10_1607--x64
OSmicrosoftwindows_10_1607--x86
OSmicrosoftwindows_10_1809--x64
OSmicrosoftwindows_10_1809--x86
OSmicrosoftwindows_10_21h2--arm64
OSmicrosoftwindows_10_21h2--x64
OSmicrosoftwindows_10_21h2--x86
OSmicrosoftwindows_10_22h2--arm64
OSmicrosoftwindows_10_22h2--x64
OSmicrosoftwindows_10_22h2--x86
OSmicrosoftwindows_11_24h2--arm64
OSmicrosoftwindows_11_24h2--x64
OSmicrosoftwindows_11_25h2--arm64
OSmicrosoftwindows_11_25h2--x64
OSmicrosoftwindows_11_26h1--arm64
OSmicrosoftwindows_11_26h1--x64
OSmicrosoftwindows_server_2012---
OSmicrosoftwindows_server_2012r2--
OSmicrosoftwindows_server_2016--x64
OSmicrosoftwindows_server_2019--x64
OSmicrosoftwindows_server_2022--x64
OSmicrosoftwindows_server_2025--x64

Explore more