What is CVE-2026-113609?

CVE-2026-113609 is a low-severity vulnerability in Bandisoft Bandizip, classified under Protection Mechanism Failure. CVSS score: 3.3/10. Published 2026-10-20.

How severe is CVE-2026-113609?

Low severity. CVSS v3 base score is 3.3 out of 10.

Vulnerability in Bandisoft Bandizip

CVE-2026-113609

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the user invokes them.

Published 2026-10-20 · last modified 2026-10-20.

CVSS v3 metric

CVSS v3 base score 3.3 (Low). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Bandisoft Bandizip

Weakness classification (CWE)

CWE-693 — Protection Mechanism Failure

References

en.bandisoft.com/bandizip/history/ (release-notes, vendor-advisory)
www.vulncheck.com/advisories/bandisoft-bandizip-before-7.47-mark-of-the-web-byp… (third-party-advisory)

Frequently asked questions

What is CVE-2026-113609?: CVE-2026-113609 is a low-severity vulnerability in Bandisoft Bandizip, classified under Protection Mechanism Failure. CVSS score: 3.3/10. Published 2026-10-20.
How severe is CVE-2026-113609?: Low severity. CVSS v3 base score is 3.3 out of 10.