Sign in

7.4 High

CVE-2026-21521 Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose…

Description

Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft 365 Word Copilot	Versions not published

The 2 CVEs of Microsoft 365 Word Copilot →

CVE-2025-59252 Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized… 9.3 Critical

Do you use Microsoft 365 Word Copilot?

Track this CVE Watch Microsoft 365 Word Copilot Check my SBOMs

www.cveye.io/en/cve/CVE-2026-21521

Timeline

Published January 22, 2026
Last modified July 30, 2026

References

Word Copilot Information Disclosure Vulnerability msrc.microsoft.com

Track this CVE