🟠 High | Source: Microsoft Security Response Center
CVE-2026-40400 is a remote code execution vulnerability in Windows PowerShell, meaning an attacker could potentially run arbitrary commands on an affected system without physical access. Although categorised under Azure advisories, this vulnerability affects Windows environments broadly, including cloud-hosted virtual machines and hybrid infrastructure relying on PowerShell for management. The acknowledgement update suggests the advisory details are still evolving, so organisations should monitor for patch availability.
Security Architect’s Take: Audit your Azure VMs, Azure Virtual Desktop environments, and any Windows-based automation pipelines that expose PowerShell remotely, and ensure Windows Update policies are enforced promptly once a patch is released. In the interim, consider restricting PowerShell Remoting (WinRM) access via Network Security Groups and Just-In-Time VM access to limit the attack surface.
Original advisory: CVE-2026-40400 Windows PowerShell Remote Code Execution Vulnerability