Cyber Posture

CVE-2026-32194

CriticalRCE

Published: 19 March 2026

Published
19 March 2026
Modified
14 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.0th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-32194 is a critical-severity Command Injection (CWE-77) vulnerability in Microsoft Bing Images. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

SI-10 directly addresses improper neutralization of special elements by requiring validation of all information inputs to prevent command injection in Microsoft Bing Images.

prevent

SI-2 ensures timely identification, reporting, and correction of flaws like CVE-2026-32194 through vendor patches provided by Microsoft's Security Response Center.

detect

SI-4 enables real-time monitoring of system activities to detect anomalous command executions indicative of successful command injection exploitation.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.003 Windows Command Shell Execution
Adversaries may abuse the Windows command shell for execution.
Why these techniques?

Command injection vulnerability in public-facing Microsoft Bing Images enables unauthenticated remote exploitation for arbitrary code execution, directly mapping to T1190 (Exploit Public-Facing Application) and facilitating T1059.003 (Windows Command Shell) as a Microsoft service.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.

Deeper analysisAI

CVE-2026-32194 is a command injection vulnerability (CWE-77) in Microsoft Bing Images, caused by improper neutralization of special elements used in a command. Published on 2026-03-19T22:16:41.130, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical due to its high impact on confidentiality, integrity, and availability.

The vulnerability can be exploited by an unauthorized attacker over the network, with low attack complexity, no required privileges, and no user interaction. Successful exploitation enables the attacker to execute arbitrary code on the affected component.

Microsoft's Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32194 provides guidance on mitigation and updates for this vulnerability.

Details

CWE(s)

Affected Products

microsoft
bing images
all versions

CVEs Like This One

CVE-2026-32191Same product: Microsoft Bing Images
CVE-2026-35428Same vendor: Microsoft
CVE-2025-59286Same vendor: Microsoft
CVE-2025-55227Same vendor: Microsoft
CVE-2025-59272Same vendor: Microsoft
CVE-2025-59252Same vendor: Microsoft
CVE-2026-32183Same vendor: Microsoft
CVE-2026-20841Same vendor: Microsoft
CVE-2025-61787Same vendor: Microsoft
CVE-2025-24049Same vendor: Microsoft

References