Skip to main content

Microsoft 365 Copilot CVE-2026-26129

| EUVD-2026-28445 HIGH
Improper Neutralization of Special Elements (CWE-138)
2026-05-07 microsoft GHSA-hpvr-rjcg-4q53
Information Disclosure
7.5
CVSS 3.1
Temporal: 6.5
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
May 07, 2026 - 22:01 vuln.today
CVE Published
May 07, 2026 - 20:58 nvd
HIGH 7.5

DescriptionNVD

Improper neutralization of special elements in M365 Copilot allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Remote unauthenticated attackers can disclose sensitive information from Microsoft 365 Copilot's Business Chat through improper input neutralization (CVSS 7.5). The vulnerability allows network-based exploitation with low complexity and no user interaction required. …

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: inventory all Microsoft 365 Copilot Business Chat deployments and identify affected versions. Within 7 days: apply vendor-released patch MSRC-2026-26129 from Microsoft Security Response Center across all affected instances, prioritizing production environments. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-26129 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy