Microsoft 365 Copilot vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Microsoft 365 Copilot: 36 record(s), with affected versions and fixes.cpe:2.3:a:microsoft:365_copilot
CVE-2026-85887
High · 7.7
CWE-732 Sep 17, 2026
M365 Copilot Information Disclosure Vulnerability
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.
CVE-2026-85885
Critical · 9.9
CWE-77 Sep 17, 2026
Microsoft 365 Copilot Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.
CVE-2026-58617
Critical · 9.8
CWE-284 Jul 14, 2026
Improper Access Control in Microsoft 365 Copilot
Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-50387
High · 7.8
CWE-121 Jul 14, 2026
Windows GDI Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.
CVE-2026-48561
Critical · 9.6
CWE-77 Jul 14, 2026
Command Injection in Microsoft 365 Copilot
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.
CVE-2026-41106
Critical · 9.3
CWE-601 Jul 2, 2026
Microsoft 365 Copilot Elevation of Privilege Vulnerability
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-47645
High · 8.8
CWE-601 Jun 19, 2026
Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-42895
High · 7.5
CWE-77 Jun 19, 2026
Microsoft Copilot Tampering Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
CVE-2026-54130
High · 7.5
CWE-306 Jun 18, 2026
M365 Copilot Information Disclosure Vulnerability
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-45474
High · 8.4
CWE-787 Jun 9, 2026
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-45472
High · 8.4
CWE-787 Jun 9, 2026
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-45463
High · 8.4
CWE-121 Jun 9, 2026
Microsoft Office Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-45461
High · 8.4
CWE-787 Jun 9, 2026
Microsoft Office Remote Code Execution Vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-45460
Medium · 4.7
CWE-126 Jun 9, 2026
Microsoft Office Information Disclosure Vulnerability
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.
CVE-2026-45497
High · 8.8
CWE-77 Jun 4, 2026
Microsoft M365 Copilot Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.
CVE-2026-42824
High · 7.5
CWE-77 Jun 4, 2026
M365 Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-42827
High · 7.5
CWE-77 May 22, 2026
M365 Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-41090
Critical · 9.3
CWE-77 May 22, 2026
Microsoft Copilot Tampering Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
CVE-2026-42831
High · 7.8
CWE-122 May 12, 2026
Microsoft Office Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-41614
Medium · 6.2
CWE-284 May 12, 2026
M365 Copilot for Desktop Spoofing Vulnerability
Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.
CVE-2026-41100
Medium · 4.4
CWE-284 May 12, 2026
Microsoft 365 Copilot for Android Spoofing Vulnerability
Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.
CVE-2026-40363
High · 8.4
CWE-122 May 12, 2026
Microsoft Office Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2026-33102
Critical · 9.3
CWE-601 Apr 23, 2026
Microsoft 365 Copilot Elevation of Privilege Vulnerability
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-24299
Medium · 5.3
CWE-77 Mar 19, 2026
M365 Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-26133
High · 7.1
CWE-77 Mar 16, 2026
M365 Copilot Information Disclosure Vulnerability
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.