Microsoft 365 Copilot CVE-2025-59252
CRITICALAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Word Copilot over network
-
DeliverySubmit input with crafted command elements
-
ExploitImproper neutralization injects command (CWE-77)
-
ExecutionService executes across scope boundary
-
ImpactDisclose sensitive information
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and only low attack complexity are required to reach and trigger the flaw over the network against Microsoft 365 Word Copilot. The specific limiting factor is product-scope rather than configuration: exploitation requires access to the Word Copilot feature/endpoint, and because this is a Microsoft-operated cloud service, the realistic exposure window is bounded by Microsoft's service-side remediation rather than by any customer-controlled setting. The exact feature, protocol, or input channel that carries the injected command is not stated in the single available advisory, so the concrete trigger could not be extracted from the provided data. |
| Impact | Signals are mixed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N, base 9.3 Critical) describes a network-reachable, low-complexity command injection requiring no privileges and no user interaction, with a scope change and high confidentiality impact - on paper a top-priority flaw. However, EPSS is only 0.57% (45th percentile), there is no CISA KEV listing, and no public exploit was identified, which pulls the real-world near-term risk well below what the 9.3 implies. The primary caveat: this is a Microsoft-hosted cloud/service-side Copilot component with a single terse MSRC advisory, so 'PR:N/UI:N' and the network vector reflect the service boundary rather than a self-hostable product an attacker can freely probe; Microsoft likely remediated it service-side, limiting the window for exploitation. Net assessment: a genuinely high-severity information-disclosure bug by design, but current exploitation likelihood is low and appears non-widespread - treat as important to confirm patched, not as an active-exploitation fire drill. Conflict to note explicitly: CVSS indicates critical network exploitability while EPSS/KEV/POC all indicate no observed exploitation - verify current status with Microsoft's advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker crafts input (e.g., document content or a prompt processed by Word Copilot) containing special command elements that are improperly neutralized, causing the service to execute injected commands and return data the attacker should not see. Because scope is changed and confidentiality impact is High, the disclosed information can belong to a system or tenant beyond the vulnerable component. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
Command injection in Microsoft 365 Word Copilot allows an unauthenticated remote attacker to disclose information from the service, with the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) indicating that no credentials, no user interaction, and only low attack complexity are needed to reach and trigger the flaw over the network, and that exploitation can affect resources beyond the vulnerable component's own security scope while the primary impact is high confidentiality loss with limited integrity impact. Because the vulnerable component is a Microsoft-operated cloud service rather than a customer-installed product, exposure is bounded by Microsoft's service-side remediation window instead of any customer-controlled configuration, and the single available MSRC advisory does not disclose the specific feature, protocol, or input channel that carries the injected command. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS is 0.57% (45th percentile), placing predicted near-term exploitation slightly below the median, so the very high base score reflects theoretical worst-case severity rather than observed attacker activity.
RemediationAI
Because this is a Microsoft-hosted cloud service, remediation is primarily service-side and tenants cannot install a patch themselves; Microsoft's remediation guidance and any service update details are published in the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59252, and no exact fixed build or version identifier is provided in the available data, so patch availability should be described only as 'patch available per vendor advisory'. Until Microsoft confirms service-side remediation, the most direct compensating control is to disable or restrict Copilot access for affected tenants or user groups (for example, by turning off the Copilot license assignment or the Copilot feature in Word through Microsoft 365 admin controls), accepting the trade-off that users lose Copilot functionality for the period of restriction. A narrower alternative is to limit Copilot enablement to a small, trusted pilot group and monitor Microsoft Purview audit logs and Copilot interaction logs for anomalous prompt or response activity, accepting that this reduces blast radius but does not eliminate exposure for enabled users. Keep Word clients and Microsoft 365 Apps updated through the standard update channel in case any client-side component is also implicated, and treat the MSRC advisory as the single source of truth since no independent patch version, workaround registry key, or port-blocking mitigation is documented in the supplied references.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-77, Improper Neutralization of Special Elements used in a Command ('command injection'), a weakness in which externally supplied input reaches a command interpreter or shell without adequate escaping or allow-listing, allowing an attacker to append or substitute command syntax. The affected component is Microsoft's cloud-hosted Copilot integration for Word, identified by CPE cpe:2.3:a:microsoft:365_word_copilot:-:*:*:*:*:*:*:*, which is a service-delivered AI assistant reached through Microsoft 365 rather than a standalone on-premises binary, so the vulnerable attack surface lives in Microsoft's backend request-processing pipeline that receives prompts and context from the Word client. The CVSS scope value S:C indicates that a successful exploit crosses a security boundary and can affect resources outside the vulnerable component itself, consistent with a backend command execution context that has access to data beyond the requester's own scope; the C:H/I:L/A:N impact triad indicates the demonstrated consequence is disclosure of protected information, with some but not full integrity impact, and no availability impact. The provided advisory does not specify the parameter, endpoint, or prompt-handling path that is injectable, so the exact trigger and the interpreter being reached (for example, an internal shell, orchestration call, or tool-invocation layer) remain unconfirmed from available data.
Know when 365 Word Copilot gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Network-reachable command injection in a cloud Copilot service with no auth or interaction (AV:N/AC:L/PR:N/UI:N); scope change (S:C) with information disclosure gives C:H, minor I:L, no A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
Executive ViewAI
Microsoft 365 Word Copilot contains a critical unauthenticated command-injection flaw that could allow a remote attacker to disclose information from the service, putting organizations that use Copilot with sensitive content at risk. Because this is a Microsoft-operated cloud service with no vendor-released patch identified at time of analysis, remediation depends on Microsoft's service-side timeline rather than customer-controlled patching. Leadership should treat this as a high-priority cloud exposure until Microsoft confirms remediation, especially where Copilot can access confidential business data.
No vendor-released patch identified; interim mitigations are limited to monitoring the MSRC advisory and Microsoft service-side remediation, restricting Microsoft 365 Word Copilot access to sensitive data, enforcing data loss prevention and sensitivity labels, and reviewing audit logs for anomalous activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
GitHub PoC
Exploit-DB