---
id: 9421
title: "Shift Happens – Uncovering Two Built-in Command Injections in Windows Context Menus"
source_domain: specterops.io
source_url: "https://specterops.io/blog/2026/05/07/shift-happens-uncovering-two-built-in-command-injections-in-windows-context-menus/"
published_at: "2026-05-07T16:00:00Z"
phying_url: "https://phying.com/item/9421"
lang: en
---

# Shift Happens – Uncovering Two Built-in Command Injections in Windows Context Menus

## Summary

Two long-standing Windows Explorer vulnerabilities lets attackers execute arbitrary PowerShell commands using crafted folder names, affecting Windows 10 and 11 since 2017.

## Intelligence Metadata

- **Sources:** specterops.io
- **Published:** 2026-05-07T16:00:00Z
- **Original:** https://specterops.io/blog/2026/05/07/shift-happens-uncovering-two-built-in-command-injections-in-windows-context-menus/
- **Phying News:** https://phying.com/item/9421