CVE-2026-24301

Microsoft Copilot has an improper neutralization of special elements used in a command (command injection ) flaw. A network-based, unauthenticated attacker with user interaction can disclose information. CVSS 3.1 scores 8.8 HIGH (C:H/I:H/A:H). No in-the-wild exploitation or patch version is docum...

CVE-2026-42824

Technical details (affected products, root cause specifics, exploit vectors, and fixes) are not publicly available in the provided documents. Monitor official advisories for updates.

CVE-2026-45497

CVE-2026-45497 affects Microsoft Copilot (M365 Copilot). According to the description, it involves improper neutralization of special elements in a command (command injection) that could allow an authorized attacker to execute code over a network. The connected documents do not provide concrete t...

CVE-2026-55145

The CVE-2026-55145 entry concerns Outlook Copilot and describes improper neutralization of special elements used in a command (command injection) that could allow an authorized attacker to tamper over a network. Connected sources corroborate with MSRC and NVD summaries and indicate exploitation s...

CVE-2026-55946

CVE-2026-55946 is a command injection vulnerability in Microsoft Copilot resulting from improper neutralization of special elements used in a command. An unauthorized remote attacker can leverage this to disclose information over a network . The CVSS 3.1 score is 6.1 (MEDIUM) with the vector AV:N...

CVE-2026-26136

CVE-2026-26136 is a command injection vulnerability in Microsoft Copilot caused by improper neutralization of special elements in commands. The issue enables an unauthenticated attacker to disclose information over the network. Affected product: Microsoft Copilot (including Copilot components ref...