Microsoft 365 Copilot Command Injection Vulnerability (CNVD-2026-26512)

Microsoft 365 Copilot is an AI assistant integrated into the Microsoft 365 office suite. It offers features such as intelligent writing, data analysis, and content generation. Microsoft 365 Copilot has a command injection vulnerability. This vulnerability arises from the failure to properly...

tmux image.c image_free use after free

...

CVE-2026-48582

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network...

CVE-2026-47645

Url redirection to untrusted site 'open redirect' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-42895

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...

CVE-2026-32208

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Entra ID allows an authorized attacker to perform spoofing over a network...

CVE-2026-47645

Url redirection to untrusted site 'open redirect' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-47645

Summary: CVE-2026-47645 is an open redirect vulnerability in Microsoft 365 Copilot’s Business Chat that can lead to privilege escalation over a network. The issue is described across sources (NVD/MSRC/CVE records) as a url redirection to an untrusted site, with a CVSS v3.1 base score of 8.8 (HIGH...

CVE-2026-47645 Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability

...

CVE-2026-47645 Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability

...

EUVD-2026-38091

Url redirection to untrusted site 'open redirect' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-48582

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network...

EUVD-2026-38090

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network...

CVE-2026-48582 Microsoft Exchange Online Elevation of Privilege Vulnerability

...

CVE-2026-48582 Microsoft Exchange Online Elevation of Privilege Vulnerability

...

CVE-2026-48582

This CVE affects Microsoft Exchange Online. Missing authorization could allow an attacker with low privileges and network access (no user interaction) to elevate privileges (impact: high confidentiality and integrity, no availability impact) per CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base...

CVE-2026-50519 Microsoft Visual Studio Code CoPilot Chat Security Feature Bypass Vulnerability

...

CVE-2026-48584 Microsoft Azure Synapse Elevation of Privilege Vulnerability

...

EUVD-2026-38087

Improper neutralization of special elements used in a command 'command injection' in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network...

CVE-2026-42895

Microsoft Copilot vulnerability CVE-2026-42895 involves improper neutralization of special elements used in a command (command injection) that could allow an unauthorized attacker to tamper with data over a network. Affected component is Microsoft Copilot; root cause is improper input handling le...