Microsoft Windows Notepad < 11.2510 Command Injection (February 2026)

The Windows 'Microsoft Windows Notepad' app installed on the remote host is prior to version 11.2510. It is, therefore, affected by a command injection vulnerability: - Improper neutralization of special elements used in a command allows an unauthorized attacker to execute code over a network...

CVE-2026-20841

Improper neutralization of special elements used in a command 'command injection' in Windows Notepad App allows an unauthorized attacker to execute code locally...

CVE-2026-20841 Windows Notepad App Remote Code Execution Vulnerability

...

CVE-2026-20841

Improper neutralization of special elements used in a command 'command injection' in Windows Notepad App allows an unauthorized attacker to execute code locally...

CVE-2026-20841 Windows Notepad App Remote Code Execution Vulnerability

...

CVE-2026-20841

CVE-2026-20841 : The description identifies an issue in the Windows Notepad App where the attacker can trigger a remote command-injection due to improper neutralization of special elements in a command. Affected: Windows Notepad App. Root cause: improper neutralization of special elements used in...

Windows Notepad App Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Windows Notepad App allows an unauthorized attacker to execute code locally...

PT-2026-7330

Name of the Vulnerable Software and Affected Versions Windows Notepad versions prior to 11.2502.1.0 Windows 10 and Windows 11 versions prior to February 2026 Patch Tuesday Description A command injection issue exists in the modern Microsoft Store version of the Windows Notepad app due to improper...

Microsoft Windows Notepad 命令注入漏洞

Microsoft Windows Notepad is a text editor program from Microsoft USA. A command injection vulnerability exists in Microsoft Windows Notepad. The vulnerability stems from the application failing to properly filter constructed command special characters, commands, etc. An attacker could exploit th...

KLA90876 ACE vulnerability in Microsoft Apps

A remote code execution vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to execute arbitrary code, bypass security restrictions. Original advisories CVE-2026-20841 Exploitation Public exploits exist for this vulnerability. Malware exists for this...

CVE-2026-20841: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Windows Notepad App allows an unauthorized attacker to execute code locally...

Parallax RAT Targeting Cryptocurrency Firms with Sophisticated Injection Techniques

Cryptocurrency companies are being targeted as part of a new campaign that delivers a remote access trojan called Parallax RAT. The malware "uses injection techniques to hide within legitimate processes, making it difficult to detect," Uptycs said in a new report. "Once it has been successfully...