Microsoft Bing
Monthly
Remote code execution in Microsoft Bing lets an unauthenticated network attacker run arbitrary code by submitting untrusted serialized data that the service deserializes unsafely (CWE-502). The flaw carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning exploitation of the Bing service could impact resources beyond its own security authority. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is a modest 0.27% (51st percentile), reflecting probability rather than confirmed activity.
Microsoft Bing contains a server-side request forgery (SSRF) vulnerability that allows elevation of privilege through improperly validated requests. The flaw affects Microsoft Bing across all versions and enables attackers to bypass access controls and escalate privileges by causing the application to make unintended requests to internal or external resources. A vendor-released patch is available.
Remote code execution in Microsoft Bing lets an unauthenticated network attacker run arbitrary code by submitting untrusted serialized data that the service deserializes unsafely (CWE-502). The flaw carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning exploitation of the Bing service could impact resources beyond its own security authority. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is a modest 0.27% (51st percentile), reflecting probability rather than confirmed activity.
Microsoft Bing contains a server-side request forgery (SSRF) vulnerability that allows elevation of privilege through improperly validated requests. The flaw affects Microsoft Bing across all versions and enables attackers to bypass access controls and escalate privileges by causing the application to make unintended requests to internal or external resources. A vendor-released patch is available.