Which versions of Windows are affected by CVE-2026-32000?

CVE-2026-32000 presents moderate security risk, a OS command injection vulnerability rated CVSS 5.8. Exploitation could allow attackers to execute code or inject malicious input.. A patch is available.

How to fix or mitigate CVE-2026-32000?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Validate input sanitization for user-controlled parameters.

Windows CVE-2026-32000

Q: What is the CVSS score of CVE-2026-32000?

CVE-2026-32000 has a CVSS 4.0 base score of 5.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-13039 MEDIUM

OS Command Injection (CWE-78)

2026-03-19 VulnCheck

GHSA-7fcc-cw49-xm78

Command Injection Microsoft Windows

5.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 01:30 euvd

EUVD-2026-13039

Analysis Generated

Mar 19, 2026 - 01:30 vuln.today

Patch released

Mar 19, 2026 - 01:30 nvd

Patch available

CVE Published

Mar 19, 2026 - 01:00 nvd

MEDIUM 5.8

DescriptionCVE.org

OpenClaw versions prior to 2026.2.19 contain a command injection vulnerability in the Lobster extension tool execution that uses Windows shell fallback with shell: true after spawn failures. Attackers can inject shell metacharacters in command arguments to execute arbitrary commands when subprocess launch fails with EINVAL or ENOENT errors.

AnalysisAI

Command injection in OpenClaw versions before 2026.2.19 allows local attackers with limited privileges to execute arbitrary commands when the Lobster extension tool falls back to Windows shell execution after subprocess failures. The vulnerability exists because the tool uses shell: true after spawn errors, enabling attackers to inject shell metacharacters into command arguments. A patch is available for affected users.

Technical ContextAI

The vulnerability exists in OpenClaw's Lobster extension tool execution subsystem, which handles external process spawning. According to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), the root cause is the unsafe use of shell=true in subprocess operations as a fallback mechanism after initial spawn failures. When the initial spawn attempt fails with EINVAL (Invalid Argument) or ENOENT (No Such File or Directory) errors, the code retries with Windows shell invocation enabled, but does not properly sanitize or escape command arguments. This allows attackers to embed shell metacharacters (such as pipes, redirects, or command separators) in arguments that are then interpreted by the Windows command shell rather than passed as literal strings. The affected product is OpenClaw (CPE: cpe:2.3:a:openclaw:openclaw:*:*:*:*:*:*:*:*), and the vulnerability is specific to Windows environments where shell fallback is triggered.

RemediationAI

Upgrade OpenClaw to version 2026.2.19 or later, which includes the patch fixing the shell fallback command injection vulnerability (commit ba7be018da354ea9f803ed356d20464df0437916 available at https://github.com/openclaw/openclaw/commit/ba7be018da354ea9f803ed356d20464df0437916). For systems unable to patch immediately, restrict local access to OpenClaw installations to trusted users only, disable or isolate the Lobster extension tool if not essential, and monitor subprocess execution patterns for anomalous command invocations. Ensure that the system does not rely on fallback mechanisms by validating tool paths and executable availability before OpenClaw startup. Complete the patch deployment as soon as feasible, as the vulnerability allows arbitrary command execution once triggered.