Loading story…
XBOW disclosed three critical Microsoft remote code execution flaws, including two in Bing Images and one in the Microsoft Devices Pricing Program, after reporting them through coordinated vulnerability disclosure. The issues are identified as CVE-2026-32194, CVE-2026-32191, and CVE-2026-21536, and XBOW said Microsoft rated all three CVSS 9.8. According to the disclosure, the two Bing Images bugs were reachable over the network without authentication or user interaction and stemmed from attacker-controlled SVG content being passed into a backend image-processing pipeline where command injection became possible.
XBOW said its research began with a blind SSRF in reverse image search and expanded into parser and renderer testing that pointed to an ImageMagick or ImageMagick-compatible delegate-backed conversion path. The company reported benign out-of-band proof-of-execution from production Bing image-processing workers, including Windows Server 2022 systems running commands as NT AUTHORITY\SYSTEM and Linux workers returning uid=0/gid=0. The third flaw, CVE-2026-21536, reportedly allowed unrestricted upload of server-executable files in the Microsoft Devices Pricing Program, underscoring how image converters, delegates, and upload handlers can become high-impact execution points when exposed to untrusted content.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On July 23, 2026, XBOW published details of three critical Microsoft vulnerabilities, including two Bing Images command-injection issues and one unrestricted file-upload issue in the Microsoft Devices Pricing Program. The same day, a Reddit post amplified the claim that the Bing Image Search flaws could yield SYSTEM or root-level execution.
According to XBOW, it validated the Bing Images flaws with benign out-of-band callbacks from production image-processing workers. The testing reportedly showed command execution as NT AUTHORITY\SYSTEM on Windows Server 2022 systems and as uid=0/gid=0 on Linux workers.
XBOW says it discovered three critical remote code execution vulnerabilities affecting Bing Images and the Microsoft Devices Pricing Program, and privately reported them through Coordinated Vulnerability Disclosure before discussing them publicly. The flaws are identified as CVE-2026-32194, CVE-2026-32191, and CVE-2026-21536.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft disclosed a set of security flaws affecting cloud and AI services, including **Microsoft 365 Copilot**, **Microsoft Copilot**, **Microsoft 365 Copilot BizChat**, **Azure DevOps**, **Azure Cloud Shell**, **Azure Data Factory**, **Microsoft Bing**, and **Microsoft Bing Images**. The issues span **information disclosure**, **elevation of privilege**, **tampering**, and **remote code execution**, with published identifiers including `CVE-2026-24299`, `CVE-2026-26136`, `CVE-2026-26137`, `CVE-2026-23658`, `CVE-2026-32169`, `CVE-2026-23659`, `CVE-2026-26120`, and `CVE-2026-32191`. Germany's dCERT separately highlighted multiple vulnerabilities in **Microsoft 365 Copilot**, underscoring enterprise concern around AI-assisted productivity platforms. The most severe issue in the group is **`CVE-2026-32191`**, a **critical remote code execution** flaw in **Microsoft Bing Images**. Public reporting tied the bug to **OS command injection** caused by improper neutralization of special elements in a command, potentially allowing an unauthenticated attacker to execute code over a network. Additional Bing exposure was tracked as **`CVE-2026-26120`**, a tampering vulnerability, while the Copilot-related flaws included both **information disclosure** and **privilege escalation**, indicating risk to data confidentiality and tenant-level access boundaries across Microsoft's hosted services.
Jul 24, 2026
Microsoft published multiple security advisories for **Windows**, **Azure**, and **developer tooling**, including several high-impact issues spanning **remote code execution (RCE)**, **elevation of privilege (EoP)**, **spoofing**, **information disclosure**, **denial of service**, and **security feature bypass**. Notable items include **Azure SDK for Python RCE** `CVE-2026-21531` (CVSS 9.8; **deserialization of untrusted data**), **Windows Shell security feature bypass** `CVE-2026-21510` (CVSS 8.8; exploitability listed as **E:F**), **GitHub Copilot/Visual Studio/VS Code** issues enabling **RCE/EoP/feature bypass** (`CVE-2026-21256`, `CVE-2026-21523`, `CVE-2026-21257`, `CVE-2026-21518`), and **Azure Local RCE** `CVE-2026-21228` (CVSS 8.1; **improper certificate validation**). Additional Windows platform flaws include **Desktop Window Manager EoP** `CVE-2026-21519` (type confusion), **HTTP.sys EoP** `CVE-2026-21232` (untrusted pointer dereference), **WinSock Ancillary Function Driver EoP** `CVE-2026-21238` (improper access control), **Windows Storage EoP** `CVE-2026-21508`, **WSL EoP** `CVE-2026-21237`, **Microsoft Word security feature bypass** `CVE-2026-21514`, **Outlook spoofing** `CVE-2026-21511`, **Windows LDAP DoS** `CVE-2026-21243`, plus **ACI Confidential Containers information disclosure** `CVE-2026-23655` and **Azure IoT Explorer information disclosure** `CVE-2026-21528`. Separately, a detailed third-party writeup described a **Windows Error Reporting Service** local privilege escalation, `CVE-2026-20817`, patched in January 2026, where the **WER service** (`wersvc.dll`) running as `NT AUTHORITY\SYSTEM` allegedly fails to validate requester permissions over **ALPC**, enabling a standard user to trigger process creation with a SYSTEM-derived token (retaining powerful rights such as *SeDebugPrivilege*, *SeImpersonatePrivilege*, and *SeBackupPrivilege*). Another third-party report highlighted a long-standing **libpng** heap buffer issue, `CVE-2026-25646` (CVSS 8.3), in `png_set_quantize()` that can be triggered by a crafted PNG (palette present, histogram absent) leading to an infinite loop/out-of-bounds read with potential for DoS and, with heap grooming, possible code execution; an additional MSRC entry referenced **libjpeg-turbo** `CVE-2023-2804` (heap-based overflow) as an Important RCE-class issue. Collectively, the disclosures reinforce the need to prioritize patching for internet-reachable components and developer tooling, and to treat local EoP bugs as high-risk in post-compromise and lateral movement scenarios.
Jun 29, 2026
Microsoft disclosed **CVE-2025-33053**, an **Important** remote code execution flaw in **Internet Shortcut Files** that affects all supported versions of Windows and carries a **CVSS 8.8** rating. The vulnerability is tied to **CWE-73** (external control of file name or path) and can let an unauthenticated attacker execute code over a network if a user clicks a specially crafted URL. Microsoft said the bug had been **exploited in the wild**, that **functional exploit code** was available, and that security updates had been released. The advisory said the issue has implications beyond legacy browser use because underlying **MSHTML**, **EdgeHTML**, and scripting components remain supported on some platforms and are still used by **Internet Explorer mode**, the **WebBrowser control**, **WebView**, and some **UWP** applications. Microsoft also noted that **IE cumulative updates** still matter for certain older Windows Server systems, and later revised the advisory to correct the CVE title and description without changing the technical impact. Related Microsoft advisories show the flaw joins a broader pattern of remote code execution risks across Windows and server products, including **MSHTML**, **Hyper-V**, **Exchange Server**, and **SharePoint Server**.
Jun 29, 2026