CVE-2026-123387
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacke
CVSS
8.0
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 10, 2026 · Last modified: Nov 10, 2026 · CWE-77
Not enough EPSS history yet.
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-960537.8 HIG—
——0Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.6hCVE-2026-839535.5 MED—
——0Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.6hCVE-2026-1216628.6 HIG—
——0Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.6hCVE-2026-1199898.2 HIG—
——0Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.6hCVE-2026-1169308.8 HIG—
——0Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.5hCVE-2026-125738.8 HIG—
——0Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.13h