What’s Vulnerable › Vulnerabilities

CVE-2026-113609: Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-20 · updated 2026-10-20
• Weakness: CWE-693

Description

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

Affected products

• Bandisoft Bandizip: before 7.47 — fixed in 7.47

How to fix

Upgrade to a fixed version: Bandisoft Bandizip 7.47. Check the vendor advisory for mitigations.

References

• https://en.bandisoft.com/bandizip/history/
• https://www.vulncheck.com/advisories/bandisoft-bandizip-before-7.47-mark-of-the-web-bypass-for-powershell-scripts

Get alerted when CVE-2026-113609 or the next vulnerability affects your stack