Vulnerabilities

Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to…

Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate privileges locally.

Read at NIST National Vulnerability Database (CVE API 2.0)

Vendor

Microsoft

Product

Windows Sandbox

CVSS v3.1

7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitation

SSVC none, automatable no, impact total

Weakness

CWE-78

NVD status

Awaiting Analysis

• NIST National Vulnerability Database (CVE API 2.0) (nvd.nist.gov)
• CVE-2026-119906 on this site · NVD · CVE.org · Vulnpedia

Other items that share a CVE or were clustered with this one.

1. 43
   CVE NVD 4h ago

   Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to…

   CVSS 8.0 CVE-2026-123387 Microsoft