CVE-2026-32191

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Mar 19, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-321927.8Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.CVE-2026-321938.8Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized atCVE-2026-321949.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attackerCVE-2026-321957.0Stack-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-321966.1Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attackerCVE-2026-321977.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-321987.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-321997.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.CVE-2026-32208.8The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9CVE-2026-322007.8Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.CVE-2026-322016.5Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.CVE-2026-322024.3Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-32191: Critical severity, CVSS 9.8 | Vulnix