CVE-2026-21520

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector...

CVE-2026-21521

Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network...

CVE-2026-21521

CVE-2026-21521 affects Copilot and corresponds to an information-disclosure vulnerability caused by improper neutralization of escape, meta, or control sequences. The Red Hat, NVD, Microsoft, EUVD, and other sources consistently describe an unauthorized attacker disclosing information over a netw...

CVE-2026-21521 Word Copilot Information Disclosure Vulnerability

...

CVE-2026-21521 Word Copilot Information Disclosure Vulnerability

...

CVE-2026-21521

Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network...

CVE-2026-24307

Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network...

CVE-2026-24307

CVE-2026-24307 affects M365 Copilot. Root cause: improper validation of a specified input type. Impact: unauthorized disclosure of information over a network (confidentiality and integrity high; CVSS 9.3). Exploitation details are not provided in the supplied documents. Remediation is expected vi...

CVE-2026-24307 M365 Copilot Information Disclosure Vulnerability

...

CVE-2026-24307 M365 Copilot Information Disclosure Vulnerability

...

CVE-2026-21520

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector...

CVE-2026-21520

CVE-2026-21520 is a Copilot Studio information disclosure vulnerability with a network attack vector, allowing an unauthenticated attacker to view sensitive information. The NVD/MSRC entry attributes a CVSS v3.1 base score of 7.5 (HIGH) and confirms network access with no privileges. Red Hat and ...

CVE-2026-21520 Copilot Studio Information Disclosure Vulnerability

...

CVE-2026-21520 Copilot Studio Information Disclosure Vulnerability

...

Word Copilot Information Disclosure Vulnerability

Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network...

Copilot Studio Information Disclosure Vulnerability

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector...

M365 Copilot Information Disclosure Vulnerability

Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network...

Microsoft Copilot Studio command injection vulnerability

Microsoft Copilot Studio is an artificial intelligence chatbot developed by Microsoft Corporation. Microsoft Copilot Studio has a command injection vulnerability, which stems from improper neutralization of certain elements. Attackers can exploit this vulnerability to access sensitive information...

PT-2026-4307

Name of the Vulnerable Software and Affected Versions Microsoft Copilot Studio versions prior to January 15, 2026 Description An issue in Microsoft Copilot Studio allows an unauthenticated remote attacker to view sensitive information via a network attack vector. The flaw is rooted in a lack of...

Microsoft M365 Copilot security vulnerabilities

Microsoft M365 Copilot is an AI-driven productivity tool developed by Microsoft Corporation. There is a security vulnerability in Microsoft M365 Copilot, which stems from improper validation of certain types of inputs. Attackers can exploit this vulnerability to leak information over the network...