Sign in

7.5 High

CVE-2026-21520 Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view…

Description

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector

Affected products and versions

Product	Affected versions	Fixed in
Microsoft Copilot Studio	Versions not published

The 5 CVEs of Microsoft Copilot Studio →

CVE-2026-80098 Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges… 9.3 Critical CVE-2024-49038 Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an… 9.3 Critical CVE-2024-43610 Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view… 7.4 High CVE-2024-38206 An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak… 8.5 High

Do you use Microsoft Copilot Studio?

Track this CVE Watch Microsoft Copilot Studio Check my SBOMs

www.cveye.io/en/cve/CVE-2026-21520

Timeline

Published January 22, 2026
Last modified July 30, 2026

References

Copilot Studio Information Disclosure Vulnerability msrc.microsoft.com

Track this CVE