CVE-2026-32194
Published: 19 March 2026
Summary
CVE-2026-32194 is a critical-severity Command Injection (CWE-77) vulnerability in Microsoft Bing Images. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32194 is a command injection vulnerability (CWE-77) in Microsoft Bing Images, caused by improper neutralization of special elements used in a command. Published on 2026-03-19T22:16:41.130, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its high impact on confidentiality, integrity, and availability.
The vulnerability can be exploited by an unauthorized attacker over the network, with low attack complexity, no required privileges, and no user interaction. Successful exploitation enables the attacker to execute arbitrary code on the affected component.
Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32194 provides guidance on mitigation and updates for this vulnerability.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13207
Vulnerability details
Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection vulnerability in public-facing Microsoft Bing Images enables unauthenticated remote exploitation for arbitrary code execution, directly mapping to T1190 (Exploit Public-Facing Application) and facilitating T1059.003 (Windows Command Shell) as a Microsoft service.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly addresses improper neutralization of special elements by requiring validation of all information inputs to prevent command injection in Microsoft Bing Images.
SI-2 ensures timely identification, reporting, and correction of flaws like CVE-2026-32194 through vendor patches provided by Microsoft's Security Response Center.
SI-4 enables real-time monitoring of system activities to detect anomalous command executions indicative of successful command injection exploitation.