Cyber Posture

CVE-2026-32194

Critical

Published: 19 March 2026

Published
19 March 2026
Modified
14 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 directly addresses improper neutralization of special elements by requiring validation of all information inputs to prevent command injection in Microsoft Bing Images.

prevent

SI-2 ensures timely identification, reporting, and correction of flaws like CVE-2026-32194 through vendor patches provided by Microsoft's Security Response Center.

detect

SI-4 enables real-time monitoring of system activities to detect anomalous command executions indicative of successful command injection exploitation.

Security SummaryAI

CVE-2026-32194 is a command injection vulnerability (CWE-77) in Microsoft Bing Images, caused by improper neutralization of special elements used in a command. Published on 2026-03-19T22:16:41.130, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its high impact on confidentiality, integrity, and availability.

The vulnerability can be exploited by an unauthorized attacker over the network, with low attack complexity, no required privileges, and no user interaction. Successful exploitation enables the attacker to execute arbitrary code on the affected component.

Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32194 provides guidance on mitigation and updates for this vulnerability.

Details

CWE(s)

Affected Products

microsoft
bing images
all versions

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.003 Windows Command Shell Execution
Adversaries may abuse the Windows command shell for execution.
Why these techniques?

Command injection vulnerability in public-facing Microsoft Bing Images enables unauthenticated remote exploitation for arbitrary code execution, directly mapping to T1190 (Exploit Public-Facing Application) and facilitating T1059.003 (Windows Command Shell) as a Microsoft service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References