6.5 Medium

CVE-2026-42895 Microsoft Copilot Tampering Vulnerability

Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

CVSS 3.1 detail

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C

Exploitable remotely over the network, without an account and if a user takes an action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector: Network
Attack complexity: Low
Privileges required: None
Interaction: Required
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Affected products and versions

Product	Affected versions	Fixed in
Microsoft 365 Copilot	Versions not published

References

Microsoft Copilot Tampering Vulnerability msrc.microsoft.com

Timeline

Published June 19, 2026
Last modified November 3, 2026

The 14 CVEs of Microsoft 365 Copilot →

CVE-2026-85887 Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose… 7.7 High CVE-2026-85885 Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized… 9.9 Critical CVE-2026-50517 Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network 9.9 Critical CVE-2026-41106 Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate… 9.3 Critical

Track this CVE