127 matches found
CVE-2026-50517
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...
CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability
...
Microsoft M365 Copilot Remote Code Execution Vulnerability
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...
KLA91174 ACE vulnerability in Microsoft Apps
Arbitrary code execution vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2026-50517 Exploitation CVE list CVE-2026-50517 critical KB list Solution Install necessary updates from the KB section, that are...
CVE-2026-59864
Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...
PT-2026-60489
Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota is an OpenAPI based HTTP Client code generator. The kiota plugin add and kiota plugin generate using the -t APIPlugin flag functions fail to validate paths in static template.file values sourced...
EUVD-2026-43965
Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to execute code over a network...
CVE-2026-58617
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-48561
Improper neutralization of special elements used in a command 'command injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to execute code over a network...
CVE-2026-58617 M365 Copilot for iOS Elevation of Privilege Vulnerability
...
CVE-2026-48561 Microsoft Edge Copilot Remote Code Execution Vulnerability
...
CVE-2026-48561 Microsoft Edge Copilot Remote Code Execution Vulnerability
...
CVE-2026-48561
CVE-2026-48561 concerns Microsoft Copilot and is described as an Improper neutralization of special elements used in a command (command injection) that allows remote code execution over a network. The CVSS 3.1 metrics from the source indicate a CRITICAL base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/...
M365 Copilot for iOS Elevation of Privilege Vulnerability
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network...
Microsoft Edge Copilot Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to execute code over a network...
PT-2026-58133
Name of the Vulnerable Software and Affected Versions Microsoft Copilot affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to execute code over a network. Recommendations At the...
CVE-2026-41106 Microsoft 365 Copilot Elevation of Privilege Vulnerability
...
CVE-2026-47645
Url redirection to untrusted site 'open redirect' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network...