CVE-2026-50517

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

Microsoft M365 Copilot Remote Code Execution Vulnerability

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...

CVE-2026-58617

Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-48561

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to execute code over a network...

CVE-2026-58617 M365 Copilot for iOS Elevation of Privilege Vulnerability

...

CVE-2026-48561 Microsoft Copilot Remote Code Execution Vulnerability

...

CVE-2026-48561 Microsoft Copilot Remote Code Execution Vulnerability

...

CVE-2026-48561

CVE-2026-48561 concerns Microsoft Copilot and is described as an Improper neutralization of special elements used in a command (command injection) that allows remote code execution over a network. The CVSS 3.1 metrics from the source indicate a CRITICAL base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/...

Microsoft Copilot Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to execute code over a network...

M365 Copilot for iOS Elevation of Privilege Vulnerability

Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-41106 Microsoft 365 Copilot Elevation of Privilege Vulnerability

...

CVE-2026-47645

Url redirection to untrusted site 'open redirect' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-42895

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...

CVE-2026-47645 Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability

...

CVE-2026-42895 Microsoft Copilot Tampering Vulnerability

...

EUVD-2026-38087

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...

CVE-2026-42895 Microsoft Copilot Tampering Vulnerability

...

CVE-2026-42895

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...

CVE-2026-42895

Microsoft Copilot vulnerability CVE-2026-42895 involves improper neutralization of special elements used in a command (command injection) that could allow an unauthorized attacker to tamper with data over a network. Affected component is Microsoft Copilot; root cause is improper input handling le...