M365-Assess

M365 Assess Comprehensive M365 Security Assessment Tool Read-only Microsoft 365 security assessment for IT consultants and administrators What is this? M365 Assess runs a single read-only command against a Microsoft 365 tenant and produces CSV data, a self-contained branded HTML report, and an XL...

untitledgoosetool

Untitled Goose Tool The Goose is loose. Table of Contents About Getting Started Prerequisites Requirements Installing Usage Config GUI Auth Csv Honk Messagetrace Recommended Default Workflow Recommended Workflow for UAL Call with Time Bounds Considerations Known Issues Acknowledgements Contributi...

EUVD-2026-82600

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

EUVD-2026-82588

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

CVE-2026-85887

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

CVE-2026-85887: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

CVE-2026-85885

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

CVE-2026-85887

CVE-2026-85887 is an information disclosure vulnerability in M365 Copilot caused by an incorrect permission assignment on a critical resource. An attacker with low privileges (authorized access) can disclose information over a network. The CVSS 3.1 score is 7.7 (HIGH) with a changed scope and hig...

CVE-2026-85885

Microsoft 365 Copilot is affected by a command injection vulnerability, classified as improper neutralization of special elements used in a command. An authorized attacker (low privileges required) can exploit this over the network without user interaction to elevate privileges , with the attack ...

M365 Copilot Information Disclosure Vulnerability

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...

CVE-2026-85885: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

MINI-V4H3-M365-FP9C

Bulletin has no description...

The vulnerability in Microsoft Word, Microsoft Office suites, and Microsoft 365 Apps for Enterprise allows a perpetrator to disclose protected information.

The vulnerability of Microsoft Word, the Microsoft Office suite, and Microsoft 365 Apps for Enterprise involves reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

The vulnerability of the web portal for managing cloud services, accounts, subscriptions, and the security of the Microsoft 365 Admin Center is related to errors in verifying cryptographic signatures. This vulnerability allows attackers to escalate their privileges.

The vulnerability of the web portal for managing cloud services, accounts, subscriptions, and the security of the Microsoft 365 Admin Center is related to errors in verifying cryptographic signatures. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotel...

CVE-2026-16053

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module...

EUVD-2026-55969

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module...

CVE-2026-16053 Path Traversal

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module...

CVE-2026-16053

ManageEngine M365 Manager Plus and M365 Security Plus (versions below 4820) are affected by an Authenticated Path Traversal vulnerability in the Exchange Online backup module. The issue is described as a path traversal flaw in an authenticated context, with CVSS 3.1 indicating network access, low...

CVE-2026-16053

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module...

PT-2026-70077

Name of the Vulnerable Software and Affected Versions ManageEngine M365 Manager Plus versions prior to 4820 ManageEngine M365 Security Plus versions prior to 4820 Description An authenticated path traversal issue exists within the Exchange Online backup module. Path traversal is a flaw that allow...