Skip to main content

Microsoft 365 Copilot CVE-2026-42824

| EUVD-2026-34334 MEDIUM
Command Injection (CWE-77)
2026-06-04 microsoft GHSA-2h2r-v7gx-3jgh
Command Injection Microsoft 365 Copilot
6.5
CVSS 3.1 · NVD
Temporal: 5.7
Share

Severity by source

NVD PRIMARY
6.5 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CIRCL (temporal)
5.7 MEDIUM
cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

2
Analysis Generated
Jun 04, 2026 - 23:03 vuln.today
CVE Published
Jun 04, 2026 - 22:00 nvd
MEDIUM 6.5

DescriptionCVE.org

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Command injection in Microsoft 365 Copilot enables unauthenticated remote attackers to exfiltrate sensitive information when a user interacts with a crafted payload. The vulnerability (CWE-77) arises from improper neutralization of special command elements processed by the Copilot service, resulting in high confidentiality impact with no integrity or availability loss. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft command-injected payload
Delivery
Deliver via shared M365 content or prompt
Exploit
Induce victim to trigger Copilot processing (UI:R)
Execution
Copilot processes unescaped command elements
Impact
Sensitive information disclosed to attacker over network
Sign in to reveal

Vulnerability AssessmentAI

Exploitation The CVSS vector PR:N confirms that no prior authentication or account privileges are required of the attacker; however, UI:R (User Interaction Required) means the attack cannot be fully automated without a victim taking an action - such as opening a shared document, submitting a Copilot prompt, or otherwise triggering Copilot processing of attacker-influenced content. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The base CVSS score of 6.5 (Medium) reflects a network-accessible attack (AV:N) with low complexity (AC:L) and no required privileges (PR:N), tempered by a requirement for user interaction (UI:R) and a scope that does not change (S:U). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malicious prompt or document containing command injection sequences and delivers it to a target Microsoft 365 Copilot user - for example, via a shared file, email, or meeting content that Copilot is asked to process. When the victim interacts with Copilot in the context of the malicious content (satisfying the UI:R requirement), the injected command elements are processed without proper neutralization, causing Copilot to disclose sensitive information - such as internal data, user context, or service-accessible content - back to the attacker over the network. …
Remediation Apply the vendor-released patch via the Microsoft Security Response Center update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42824. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-42824 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy