Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
Critical because this CVE is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog - confirmed active exploitation outranks every other signal.
CVSS score
CVSS severity
EPSS score
EPSS percentile
CISA KEV
KEV remediation due
Published
Last modified