Vulnerabilities of Microsoft Microsoft 365 Copilot

Is your version affected?

CVE	Summary	Score	Published
CVE-2026-85885	Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized…	9.9 Critical	Sep 17, 2026
CVE-2026-50517	Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network	9.9 Critical	Jul 24, 2026
CVE-2026-41106	Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate…	9.3 Critical	Jul 2, 2026
CVE-2026-54130	M365 Copilot Information Disclosure Vulnerability	9.8 Critical	Jun 18, 2026
CVE-2026-33102	Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate…	9.3 Critical	Apr 23, 2026
CVE-2026-24307	Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information…	9.3 Critical	Jan 22, 2026
CVE-2025-32711	M365 Copilot Information Disclosure Vulnerability	9.3 Critical	Jun 11, 2025