The vulnerability is an improper neutralization of special elements used in a command, allowing an attacker to inject arbitrary command‑line instructions into the Windows Shell. This flaw, identified as a command‑injection weakness (CWE‑77), effectively bypasses the OS security feature that normally sanitizes user‑supplied data, giving the attacker the potential to execute any command with the privileges of the service that owns the shell.

Affected products include Microsoft Outlook.com and several Windows operating system releases: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2 (including arm64 and x64 builds); and Windows Server 2012 R2, 2016, 2019, 2022, and 2025 (both standard and core installations). All builds are impacted unless explicitly patched.

The flaw carries a CVSS score of 8.8, indicating high severity, and it is listed in the CISA Known Exploited Vulnerabilities catalog, signaling active exploitation is occurring or imminent. The EPSS score of 10% indicates a moderate likelihood of exploitation, while the high CVSS and KEV listing strongly suggest that a network‑based attacker could exploit the flaw remotely by crafting a malicious payload that reaches the Windows Shell on a vulnerable machine.