EUVD-2026-60762
GHSA-9q66-w589-xv8x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted request to Copilot Web endpoint
-
DeliveryInject command delimiters in user-controlled input
-
ExploitInput reaches unsanitized command execution path
-
ExecutionServer executes command in constrained context
-
ImpactSensitive data returned to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Command injection prevention
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication is required per CVSS PR:N - the attack targets Copilot Web as an unauthenticated, publicly accessible network service. The SSVC Automatable=no determination implies at least one step impedes fully automated mass exploitation, possibly rate limiting, AI-model-mediated parsing behavior that introduces non-determinism, or implicit session handling not reflected in the CVSS PR:N rating. The impact is confined to confidentiality only; the injection context does not appear to permit write operations, code execution beyond the constrained environment, or availability disruption. No specific non-default configuration requirement is stated in the description. |
| Impact | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) positions this as an unauthenticated, low-complexity network-exploitable information disclosure with high confidentiality impact. However, SSVC introduces meaningful friction: Automatable=no directly conflicts with the AC:L/PR:N/UI:N CVSS metrics and implies a non-automatable step - likely rate limiting, session-tied behavior inherent to Copilot's AI interface, or a CAPTCHA-equivalent - that is not reflected in the base vector. EPSS at 1.63% (74th percentile) and SSVC Exploitation=none confirm the vulnerability has not been observed as actively exploited despite the public GitHub gist PoC. The impact ceiling of C:H with no integrity or availability consequence limits overall blast radius. This warrants prompt patching given the public PoC, but is not an emergency-severity incident absent evidence of active exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a crafted HTTP request to a publicly accessible Microsoft Copilot Web endpoint, embedding command-injection payloads in a user-controlled input field such as a prompt or query parameter. The server processes the input through an insufficiently sanitized command execution path, returning sensitive system or application data in the response. A proof-of-concept demonstrating this technique is publicly available at the GitHub gist referenced in the advisory. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 10, 2026
Command injection in Microsoft Copilot Web (copilot_web) enables unauthenticated remote attackers to exfiltrate sensitive data over the network by embedding malicious command elements in user-controlled input. The impact is strictly bounded to confidentiality - no integrity or availability loss - and a proof-of-concept is publicly available on GitHub. Despite a CVSS 7.5 score and public PoC, SSVC classifies exploitation as none with Automatable=no, and EPSS sits at 1.63%, suggesting limited real-world exploitation activity at time of analysis.
Earlier versions of this analysis (1)
Command injection (CWE-77) in Microsoft Copilot Web enables a remote unauthenticated attacker to achieve high-impact information disclosure - and potentially broader compromise - by inducing a victim user to submit specially crafted input through the web interface. The CVSS base score of 8.8 reflects High impacts across confidentiality, integrity, and availability, though the official CVE description scopes the primary disclosed impact to information disclosure only; this discrepancy is consistent with command injection primitives typically enabling full execution-layer access regardless of the stated primary impact. No public exploit code has been identified (temporal metric E:U) and an official vendor fix is available via the Microsoft Security Response Center.
RemediationAI
Microsoft has released a patch per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24301. Because Copilot Web is a Microsoft-hosted SaaS product, the fix is applied server-side by Microsoft without requiring end-user patching action; organizations should confirm their tenant is routing through Microsoft's updated backend. As a compensating control during any transition window, restricting Copilot Web access to authenticated corporate identities via Azure AD Conditional Access policies would effectively eliminate the PR:N attack surface, though this removes any unauthenticated or guest-access use cases. No exact patched version number is independently confirmable from the available data.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-77 (Improper Neutralization of Special Elements used in a Command) identifies a command injection root cause in the Microsoft Copilot Web application, confirmed by CPE cpe:2.3:a:microsoft:copilot_web:*. Command injection arises when attacker-controlled input containing shell metacharacters or command delimiters reaches an underlying command interpreter without adequate sanitization. The impact being strictly confidentiality-only (C:H/I:N/A:N) suggests the execution context is constrained - the injectable surface likely feeds a read-only subsystem, sandboxed process, or AI-mediated pipeline that returns data but does not permit write or execution primitives beyond the disclosed information.
Know when Copilot Web gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Unauthenticated network-reachable SaaS endpoint; impact confined strictly to confidentiality with no write or availability primitives confirmed.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Microsoft Copilot Web contains an unauthenticated command-injection vulnerability that allows remote attackers to exfiltrate sensitive organizational data without requiring credentials or user interaction. Although exploitation probability remains low at 1.6% (EPSS), publicly available proof-of-concept code combined with Copilot Web's broad deployment across enterprises creates significant confidentiality risk and potential regulatory exposure if user or operational data is compromised.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Exploit-DB