51 matches found
EUVD-2026-82600
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...
EUVD-2026-82588
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...
CVE-2026-85887
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...
CVE-2026-85885
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...
CVE-2026-85887
CVE-2026-85887 is an information disclosure vulnerability in M365 Copilot caused by an incorrect permission assignment on a critical resource. An attacker with low privileges (authorized access) can disclose information over a network. The CVSS 3.1 score is 7.7 (HIGH) with a changed scope and hig...
CVE-2026-85885
Microsoft 365 Copilot is affected by a command injection vulnerability, classified as improper neutralization of special elements used in a command. An authorized attacker (low privileges required) can exploit this over the network without user interaction to elevate privileges , with the attack ...
M365 Copilot Information Disclosure Vulnerability
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...
CVE-2026-85885: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...
CVE-2026-85887: Incorrect Permission Assignment for Critical Resource
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network...
CVE-2026-50517
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...
CVE-2026-50517: Deserialization of Untrusted Data
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...
CVE-2026-58617
CVE-2026-58617 affects Microsoft 365 Copilot for iOS. Connected sources describe an improper access control that allows an unauthorized attacker to elevate privileges over the network. Root cause reported as access control deficiencies in the iOS Copilot component; impact is privilege escalation ...
CVE-2026-41106: URL Redirection to Untrusted Site
Url redirection to untrusted site 'open redirect' in M365 Copilot allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-54130
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network...
CVE-2026-54130: Missing Authentication for Critical Function
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network...
CVE-2026-42824
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
KLA91081 Multiple vulnerabilities in Microsoft Apps
Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in M365 Copilot c...
CVE-2026-42824: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
PT-2026-46401
Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot Enterprise affected versions not specified Description A critical vulnerability chain known as SearchLeak allows an unauthorized attacker to exfiltrate sensitive corporate data, including email contents, MFA codes, calend...