8.8 High

CVE-2026-24301 Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an…

Description

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

Affected products and versions

Product	Affected versions	Fixed in
Copilot Web	Versions not published

Do you use Copilot Web?

Track this CVE Watch Copilot Web Check my SBOMs

www.cveye.io/en/cve/CVE-2026-24301

Timeline

Published August 18, 2026
Last modified October 30, 2026

References

Microsoft Copilot Information Disclosure Vulnerability msrc.microsoft.com

Track this CVE