What is the CVSS score of CVE-2025-59272?

CVE-2025-59272 has a CVSS 3.1 base score of 9.3 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.6%.

How to fix or mitigate CVE-2025-59272?

Within 24 hours, confirm whether Microsoft 365 Copilot Chat is deployed in your environment and restrict access to only essential users; review logs for any anomalous activity related to the service. Within 7 days, implement enhanced monitoring for command injection indicators and apply network segmentation to limit potential scope; consult Microsoft's advisory for any workarounds or updated guidance. Within 30 days, continue to monitor for a vendor patch and apply it immediately upon release; if no patch is available, consider disabling the feature or deploying additional controls such as web application firewalls (WAF) with command injection signatures, and conduct a risk assessment to determine if the service can be safely used.

Microsoft 365 Copilot CVE-2025-59272

CRITICAL

Command Injection (CWE-77)

2025-10-09 secure@microsoft.com

Information Disclosure Command Injection 365 Copilot Chat

9.3

CVSS 3.1 · Vendor: microsoft

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach Copilot Chat input interface
Delivery

Submit crafted input with unneutralized command elements
Exploit

Trigger command injection (CWE-77)
Execution

Copilot processes across scope boundary
Impact

Exfiltrate disclosed sensitive information

Vulnerability Assessment

Weakness	CWE CWE-77 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Command injection prevention MITRE ATT&CK 1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The CVE targets Microsoft 365 Copilot Chat specifically and requires the attacker to supply input containing special command elements that Copilot fails to neutralize (CWE-77), with the resulting impact being information disclosure across a changed scope boundary. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is required, but the description's 'locally' qualifier implies the attacker may need local access or a local context to the Copilot session rather than purely remote reach - this is the key limiting factor and conflicts with the AV:N metric. No specific non-default configuration is named in the advisory; because it is a Microsoft-hosted service, exploitation and remediation depend on the vendor's server-side state rather than customer deployment settings.
Impact	CVSS 3.1 base score is 9.3 (Critical) driven by a network vector with low complexity, no privileges, no user interaction, and a changed scope (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N). However, the signals conflict: the NVD/MSRC description explicitly states the attacker performs information disclosure 'locally,' which contradicts the AV:N (network) metric Microsoft assigned - this discrepancy should be verified with the vendor, as it materially changes who can reach the flaw. Supporting signals temper the headline severity: EPSS is only 0.57% (45th percentile), there is no CISA KEV listing, and no public exploit code was identified, so despite the Critical rating there is currently no evidence of active or imminent widespread exploitation. The primary impact is confidentiality (C:H) with only limited integrity impact (I:L) and no availability impact, so this is a data-exposure issue rather than a code-execution or service-disruption one. Net assessment: a genuinely high-severity information-disclosure flaw in a Microsoft cloud AI service, but the low EPSS, absent KEV/POC, and the network-vs-local ambiguity suggest it is a high-CVSS issue that is not yet a confirmed active-exploitation priority - treat it as important-but-not-emergency pending vendor clarification. Note also that because 365 Copilot Chat is a Microsoft-operated cloud service, remediation is largely server-side and outside customer patch control.
Exploit ScenarioDerived	An attacker crafts input containing special command elements that Copilot Chat fails to neutralize (consistent with CWE-77 command injection), causing the assistant to disclose information it should not expose across a trust boundary (scope change). No public exploit code has been identified, and no authentication or user interaction is required per the assigned CVSS vector. The description's reference to 'locally' leaves the exact delivery path (remote crafted request vs. local context) unconfirmed.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.6% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Oct 08, 2026

Improper neutralization of special elements (CWE-77 command injection) in Microsoft 365 Copilot Chat allows an unauthenticated attacker to trigger information disclosure that crosses a scope boundary, yielding a CVSS 3.1 base score of 9.3 (Critical) with high confidentiality impact and low integrity impact. The affected CPE is microsoft:365_copilot_chat, and the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates no privileges or user interaction are required, although the advisory's 'locally' qualifier and the independent assessment's UI:R reading suggest a local or user-driven context may be the real limiting factor. Exploitation status at time of analysis: no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS is 0.57% (45th percentile), so near-term exploitation is assessed as unlikely and the practical risk depends primarily on whether the vendor confirms the local-access precondition.

RemediationAI

No vendor patch version is specified in the available data, and because Microsoft 365 Copilot Chat is a Microsoft-hosted service, remediation is delivered server-side by the vendor rather than through a customer-installed update; track the MSRC update guide entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59272 for confirmation of the fix and any revised scoring. Until the vendor confirms remediation, the practical compensating controls are tenant-side: restrict Copilot Chat availability to users who genuinely require it (this reduces the exposed population but imposes a productivity cost and may not prevent exploitation by an authorized insider), tighten data-loss-prevention and sensitivity-label policies so Copilot cannot surface content beyond a user's intended scope (trade-off is more false-positive blocks on legitimate queries), review and constrain any connectors, plugins, or Graph-based data sources that Copilot can invoke so injected instructions cannot reach backend query or command construction (possible loss of useful integration functionality), and monitor Copilot audit logs and prompt telemetry for anomalous disclosure patterns. Note that the CVSS vector reports no privileges or user interaction required (PR:N/UI:N) while the advisory describes the impact as local and the independent assessment re-rates interaction as UI:R, so detection should not assume that only fully remote, unattended exploitation is possible; no public exploit code has been observed, so these measures are precautionary rather than incident-response driven.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

The root cause is CWE-77, improper neutralization of special elements used in a command, applied to a large language model assistant rather than a traditional OS shell. In Microsoft 365 Copilot Chat, attacker-supplied input containing special command-like elements is not stripped or escaped before being interpreted by the service, so crafted prompts or payloads can cause the assistant to disclose information outside the caller's expected scope (reflected in the S:C changed-scope metric and C:H confidentiality impact). The affected CPE, cpe:2.3:a:microsoft:365_copilot_chat, points specifically at the Microsoft-hosted 365 Copilot Chat service rather than on-premises software, meaning the vulnerable component and its fix live in Microsoft's server-side environment and are not customer-configurable. Because this is a hosted LLM-driven service, the injection surface spans prompt/instruction handling, tool or connector invocation, and any backend command or query construction the model can influence - all of which are outside customer control. The advisory's designation of the impact as local information disclosure, combined with the AV:N/UI:N vector, leaves an unresolved tension in the public scoring that the independent assessment captures by re-rating interaction as UI:R.

Know when 365 Copilot Chat gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (microsoft) PRIMARY 9.3 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

vuln.today AI 8.2 HIGH

Command-injection information disclosure reachable via submitted Copilot input with a cross-boundary (S:C) data impact; set UI:R because exploitation plausibly requires the input to be processed in a user's Copilot session, though the vendor rated UI:N.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally.

Executive ViewAI

Why It Matters

Microsoft 365 Copilot Chat contains a critical command injection vulnerability (CVE-2025-59272) that could allow unauthorized access to sensitive information within an organization's Microsoft 365 environment. Although no public exploit identified at time of analysis and near-term exploitation is assessed as unlikely, the potential for data exposure across security boundaries requires immediate attention from security leadership to assess exposure and implement interim protections until a vendor patch is available.

Business Impact: High

Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to Microsoft 365 Copilot Chat, enabling enhanced logging and monitoring for command injection attempts, applying network segmentation, and consulting Microsoft's advisory for any additional workarounds.

Threat Intelligence Overview

EPSS Score

0.6%

Top 55% exploitable

Prevalence

High

Microsoft 365 Copilot Chat, broadly adopted across enterprise M365 tenants

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.6%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: +1

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

OS Command Injection CRITICAL

OS command injection occurs when an application passes unsanitized user input directly into system shell commands.

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.