What is the CVSS score of CVE-2026-32191?

CVE-2026-32191 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft are affected by CVE-2026-32191?

A critical remote code execution vulnerability in Microsoft Bing Images (CVE-2026-32191) allows attackers to execute arbitrary code on affected systems without authentication.. A patch is available.

How to fix or mitigate CVE-2026-32191?

Within 24 hours: Identify all systems and applications using Bing Images services; isolate or disable Bing Images functionality where feasible; enable enhanced monitoring for suspicious activity. Within 7 days: Implement network-level controls to restrict Bing Images traffic; conduct threat assessment of potentially compromised systems; establish incident response readiness. Within 30 days: Monitor Microsoft security advisories for patch availability; develop contingency plans for alternative image services; conduct full security audit of affected systems.

Microsoft CVE-2026-32191

EUVD-2026-13206 CRITICAL

OS Command Injection (CWE-78)

2026-03-19 secure@microsoft.com

Command Injection Microsoft

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 19, 2026 - 21:30 euvd

EUVD-2026-13206

Analysis Generated

Mar 19, 2026 - 21:30 vuln.today

CVE Published

Mar 19, 2026 - 21:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.

AnalysisAI

A critical OS command injection vulnerability exists in Microsoft Bing Images that allows remote attackers to execute arbitrary commands without authentication. The vulnerability enables complete system compromise with high impact to confidentiality, integrity, and availability. With a CVSS score of 9.8 and requiring no user interaction, this represents a severe risk to any systems running vulnerable versions of Bing Images.

Technical ContextAI

This vulnerability stems from improper neutralization of special elements used in OS commands (CWE-78), a class of injection flaws where user-supplied input is passed to system shell commands without proper sanitization. The affected component is Microsoft Bing Images, though specific CPE identifiers are not provided in the available intelligence. Command injection vulnerabilities occur when applications construct system commands using untrusted input, allowing attackers to inject shell metacharacters or command separators to execute unauthorized commands with the privileges of the vulnerable application.

RemediationAI

Apply security updates from Microsoft as soon as they become available through the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32191. Until patches can be applied, consider implementing network segmentation to limit access to systems running Bing Images components, deploy web application firewalls with command injection detection rules, and monitor for suspicious command execution patterns. Input validation and output encoding should be enforced at application boundaries as defense-in-depth measures.