Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
Severity
High · 8.8
CVSS base score
Exploitation
In the wild
CISA KEV
Predicted risk
2% model
EPSS forecast — overtaken by confirmed exploitation
Exposure
Remote
Exploitable over the network without credentials
01
What's the risk?
An unauthenticated attacker, remotely over the network, if a user is tricked into opening a malicious file or link, can fully compromise the system — steal data, tamper with it and take it offline.
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
How it's exploitedMITRE ATT&CK · inferred from weakness & vector
Inferred from the weakness type (CWE) and how the flaw is reached — the techniques an attacker would chain to exploit this. Real-world corroboration appears here as threat intel is folded in.
02
Who's exploiting it?
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
Confirmed exploited in the wild.CISA KEV
Named threat actors and observed ATT&CK techniques appear here as intel feeds are folded in — the ATT&CK chain above stays inferred until then.