What is the CVSS score of CVE-2026-42824?

CVE-2026-42824 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of Microsoft 365 Copilot are affected by CVE-2026-42824?

Microsoft 365 Copilot users are vulnerable to unauthenticated data exfiltration through a publicly disclosed vulnerability, affecting organizations that rely on this service for business operations.. A patch is available.

Is there a public PoC exploit available for CVE-2026-42824?

Yes, a public proof-of-concept exploit is available for CVE-2026-42824. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-42824?

Within 24 hours: Inventory all Microsoft 365 licenses with Copilot enabled and identify critical business functions depending on this feature. Within 7 days: Apply Microsoft's security patch to test Microsoft 365 tenant and verify functionality remains intact. Within 30 days: Deploy the patch to all production Microsoft 365 environments with Copilot enabled.

Microsoft 365 Copilot CVE-2026-42824

EUVD-2026-34334 HIGH

Command Injection (CWE-77)

2026-06-04 microsoft

GHSA-2h2r-v7gx-3jgh

Command Injection Microsoft 365 Copilot

7.5

CVSS 3.1 · NVD

Temporal: 5.7

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CIRCL (temporal)

5.7 MEDIUM

cvss

vuln.today AI

6.8 MEDIUM

Network-reachable and unauthenticated via poisoned content, but crafting a reliable Copilot prompt-injection chain raises AC:H; scope changes as Copilot accesses other tenant data, C:H only.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 19, 2026 - 21:29 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 19, 2026 - 21:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 19, 2026 - 21:22 vuln.today

cvss_changed

Severity Changed

Jun 19, 2026 - 21:22 NVD

MEDIUM HIGH

CVSS changed

Jun 19, 2026 - 21:22 NVD

6.5 (MEDIUM) 7.5 (HIGH)

Analysis Generated

Jun 04, 2026 - 23:03 vuln.today

CVE Published

Jun 04, 2026 - 22:00 nvd

MEDIUM 6.5

DescriptionNVD

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

AnalysisAI

Information disclosure in Microsoft 365 Copilot allows remote unauthenticated attackers to exfiltrate data via command injection (CWE-77) over the network. Microsoft reported the issue (CVE-2026-42824) with a CVSS 3.1 base score of 7.5 reflecting high confidentiality impact only, and publicly available exploit code exists though it is not listed in CISA KEV. EPSS is very low at 0.08% (24th percentile) and the CISA SSVC decision framework rates exploitation as 'none' and automatable as 'no', suggesting realistic exploitation is currently limited despite the POC.

Technical ContextAI

Microsoft 365 Copilot is Microsoft's generative-AI assistant integrated across Microsoft 365 services (Word, Excel, Outlook, Teams, and the web/desktop Copilot apps), backed by large language models that ingest tenant content and tool calls. The vulnerability is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command), meaning input intended as data is interpreted as command syntax by a downstream component. In Copilot's architecture this class of flaw typically manifests through prompt/tool-invocation handling where attacker-controlled content (for example, an indirect prompt embedded in an email, document, or web resource ingested by Copilot) is concatenated into a command or tool request without proper neutralization, causing the AI orchestration layer to perform actions the user did not intend - here, disclosing information the attacker should not be able to read.

RemediationAI

Patch available per vendor advisory - Microsoft indicates the fix is delivered service-side, so customers do not need to deploy a binary update but should review the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42824 and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-42824 to confirm tenant coverage and any required client updates. As compensating controls until coverage is confirmed, restrict Copilot's ability to ingest untrusted external content by disabling or scoping the 'Copilot with web' / Bing grounding feature (trade-off: loss of web-augmented answers), tighten Exchange and SharePoint sharing policies so that externally authored emails and documents cannot silently feed Copilot context (trade-off: reduced collaboration with external partners), and enable Microsoft Purview DLP and audit logging on Copilot interactions to detect anomalous data egress patterns (trade-off: additional licensing and review overhead). Treat the publicly posted gist at https://gist.github.com/KenjiChao/79f84ca6ca530c2609385e6318ca35f7 as actionable threat intel and hunt for the patterns it demonstrates.