Microsoft 365 Copilot vulnerabilities

CVE-2026-45497 [HIGH] CWE-77 CVE-2026-45497: Improper neutralization of special elements used in a command ('command injection') in Microsoft Cop Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.

CVE-2026-42824 [HIGH] CWE-77 CVE-2026-42824: Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disc Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2025-32711 [HIGH] CWE-74 CVE-2025-32711: Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-54130 [HIGH] CWE-306 CVE-2026-54130: Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disc Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-42895 [HIGH] CWE-77 CVE-2026-42895: Improper neutralization of special elements used in a command ('command injection') in Microsoft Cop Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

CVE-2026-33102 [CRITICAL] CWE-601 CVE-2026-33102: Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-42827 [HIGH] CWE-77 CVE-2026-42827: Improper neutralization of special elements used in a command ('command injection') in M365 Copilot Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-47645 [HIGH] CWE-601 CVE-2026-47645: Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-24307 [HIGH] CWE-1287 CVE-2026-24307: Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to di Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-24299 [MEDIUM] CWE-77 CVE-2026-24299: Improper neutralization of special elements used in a command ('command injection') in M365 Copilot Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.