801 matches found
The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant, related to the lack of measures for cleaning incoming data, allows a perpetrator to disclose protected information.
The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability could allow a malicious actor to disclose protected information remotely...
Email item data export from EWS failed
Challenge Exchange Online backup jobs in Veeam Backup for Microsoft 365 and Veeam Data Cloud for Microsoft 365 may fail to process mailboxes, returning one of the following errors: Processing mailbox failed with error: Email item data export from EWS failed item IDs: .... The operation has timed...
Kali365 phishing kit bypasses MFA and steals Microsoft logins
When the Federal Bureau of Investigation FBI publishes a dedicated public service announcement about a new phishing kit, it’s worth paying attention to. The agency is now warning about “Kali365,” a phishing‑as‑a‑service PhaaS platform that helps even low‑skilled attackers hijack Microsoft 365...
CVE-2026-42827
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
EUVD-2026-31513
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
CVE-2026-42827
CVE-2026-42827 concerns a command injection vulnerability in Microsoft 365 Copilot. The Red Hat, NVD, MSRC, and other feeds describe improper neutralization of special elements used in a command, enabling an attacker to disclose information over a network. Affected product is Microsoft 365 Copilo...
CVE-2026-42827 M365 Copilot Information Disclosure Vulnerability
...
CVE-2026-42827 M365 Copilot Information Disclosure Vulnerability
...
FBI Warns of Kali365 Phishing Service Targeting Microsoft 365 Account
FBI warns of Kali365, a PaaS scam kit that lets cybercriminals bypass MFA and hijack Microsoft 365 accounts without passwords...
Microsoft 365 Copilot 命令注入漏洞
Microsoft 365 Copilot is a generative AI collaboration assistant integrated into the Microsoft Office suite. Microsoft 365 Copilot has a command injection vulnerability, which stems from improper of special elements during command injections. This vulnerability could allow unauthorized attackers ...
PT-2026-42848
Name of the Vulnerable Software and Affected Versions M365 Copilot affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to disclose information over a network. Recommendations At the...
KLA91072 Multiple vulnerabilities in Microsoft Apps
Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in M365 Copilot can be exploited remotely to obta...
The New Phishing Click: How OAuth Consent Bypasses MFA
In February 2026, a phishing-as-a-service PhaaS platform called EvilTokens went live. Within five weeks, it had compromised more than 340 Microsoft 365 organizations across five countries. The targets of the platform received a message asking them to enter a short code at microsoft.com/devicelogi...
How Storm-2949 turned a compromised identity into a cloud-wide breach
In this article 1. Attack chain overview 1. Cloud compromise: Microsoft Entra ID and Microsoft 365 2. Initial access and persistence through targeted social engineering and SSPR abuse 3. Directory discovery and persistence 4. Microsoft 365 discovery and exfiltration 5. Cloud compromise: Microsoft...
How Storm-2949 turned a compromised identity into a cloud-wide breach
In this article 1. Attack chain overview 1. Cloud compromise: Microsoft Entra ID and Microsoft 365 2. Initial access and persistence through targeted social engineering and SSPR abuse 3. Directory discovery and persistence 4. Microsoft 365 discovery and exfiltration 5. Cloud compromise: Microsoft...
CalPhishing Scam Uses EvilTokens Kit, Outlook Invites to Steal M365 Sessions
Hackers are exploiting Outlook calendar invites and device code phishing to steal M365 session tokens, bypass MFA and breach enterprise accounts...
Microsoft 365 Copilot < 19.2604.43111.0 Spoofing (CVE-2026-41614)
The Windows 'Microsoft 365 Copilot' app formerly known as 'Microsoft 365 Office' installed on the remote host is prior to 19.2604.43111.0. It is, therefore, affected by a spoofing vulnerability: - Improper access control in Microsoft 365 Copilot for Desktop allows an unauthorized attacker to...
Achieve Federal-Grade M365 Security: Governing with Qualys SSPM and SCuBA
Qualys SaaS Security Posture Management SSPM introduces native support for the Secure Cloud Business Applications SCuBA compliance framework, bringing CISA's toughest M365 security benchmarks directly into your continuous posture monitoring workflow. Key Takeaways CISA’s Secure Cloud Business...