5.3
Medium
CVE-2026-24299 Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an…
Description
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft 365 Copilot | Versions not published |
References
- M365 Copilot Information Disclosure Vulnerability msrc.microsoft.com
Timeline
- Published
- Last modified
Other CVEs of Microsoft 365 Copilot
The 14 CVEs of Microsoft 365 Copilot →
CVE-2026-85887
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose…
7.7
High
CVE-2026-85885
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized…
9.9
Critical
CVE-2026-50517
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network
9.9
Critical
CVE-2026-41106
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate…
9.3
Critical