Critical severity9.8NVD Advisory· Published Mar 19, 2026· Updated Jun 17, 2026
CVE-2026-32191
CVE-2026-32191
Description
Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.
Affected products
2cpe:2.3:a:microsoft:bing_images:-:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:microsoft:bing_images:-:*:*:*:*:*:*:*
- (no CPE)
Patches
Vulnerability mechanics
References
1- msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32191nvdVendor Advisory
News mentions
4- ⚡ Weekly Recap: Rogue AI Agents, Check Point Exploit, Slopsquatting, ClickFix Lures and MoreThe Hacker News · Jul 27, 2026
- Weekly Cyber Security Newsletter Bulletin – Certighost Exploit, Checkpoint 0-day, HTTP/2 Flaw, Notepad++ Plugin Abuse +20 StoriesCyber Security News · Jul 26, 2026
- Bing Images Vulnerability Lets Attackers Execute Remote Code on Microsoft ServersCyber Security News · Jul 24, 2026
- Bing Images Flaws Let Crafted SVGs Run Commands as SYSTEM on Microsoft's ServersThe Hacker News · Jul 24, 2026