Sign in

7.5 High

CVE-2026-26129 Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an…

Description

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft 365 Copilot's Business Chat	Versions not published

The 7 CVEs of Microsoft 365 Copilot's Business Chat →

CVE-2026-78501 Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's… 8.6 High CVE-2026-26164 Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an… 7.5 High CVE-2025-59286 Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized… 9.3 Critical CVE-2025-59272 Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized… 9.3 Critical

Do you use Microsoft 365 Copilot's Business Chat?

Track this CVE Watch Microsoft 365 Copilot's Business Chat Check my SBOMs

www.cveye.io/en/cve/CVE-2026-26129

Timeline

Published May 7, 2026
Last modified August 10, 2026

References

M365 Copilot Information Disclosure Vulnerability msrc.microsoft.com

Track this CVE