EUVD-2026-31513
GHSA-3x26-xpc6-wm74
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Cloud service reachable over the network by an unauthorized attacker with no interaction (AV:N/AC:L/PR:N/UI:N); impact is disclosure only, so C:H, I:N, A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
6DescriptionNVD
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Information disclosure in Microsoft 365 Copilot lets an unauthorized remote attacker inject specially crafted command elements over the network to read data they should not have access to. The flaw is a command-injection weakness (CWE-77) whose impact is confined to confidentiality (C:H, no integrity or availability effect), and it was reported by Microsoft with a patch issued through the MSRC update guide. There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records exploitation status as none.
Technical ContextAI
Microsoft 365 Copilot is Microsoft's cloud-hosted generative-AI assistant embedded across Microsoft 365 apps (Word, Excel, Outlook, Teams) and Microsoft Graph, processing user prompts and organizational content server-side. The root cause is CWE-77, improper neutralization of special elements used in a command, meaning attacker-controlled input is passed into a command context without adequate sanitization. Given the network attack vector and confidentiality-only impact, the practical effect is that crafted input causes the service to surface or return data the requester is not authorized to see rather than achieving code execution. The affected component is identified by CPE cpe:2.3:a:microsoft:microsoft_365_copilot:*:*:*:*:*:*:*:*; because Copilot is a continuously updated cloud service, no discrete on-premises version is enumerated (EUVD lists 'Microsoft 365 Copilot -').
RemediationAI
Because Microsoft 365 Copilot is a cloud service, the fix is applied server-side by Microsoft; Patch available per vendor advisory, so most tenants are remediated automatically once Microsoft deploys the update described at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42827 - administrators should review that MSRC entry to confirm their tenant's status rather than applying any local package. No exact fix version is published because the service is continuously updated. As compensating measures while confirming remediation, restrict and audit Copilot access to only licensed and business-necessary users, review Copilot and Microsoft Graph data-access scoping so the assistant cannot reach content beyond a user's entitlement (limiting disclosure blast radius), and monitor Copilot audit logs for anomalous prompts or unexpected data retrieval; the trade-off of tightening access scopes is reduced Copilot functionality for some users. Verify with Microsoft support if your tenant requires any action, since cloud fixes may roll out in stages.
More in Microsoft 365 Copilot
View allInformation disclosure in Microsoft 365 Copilot allows remote unauthenticated attackers to exfiltrate data via command i
Remote code execution in Microsoft 365 Copilot allows an authenticated attacker to run arbitrary code over the network b
Privilege elevation in Microsoft 365 Copilot arises from an open redirect (CWE-601) that lets an unauthenticated remote
Privilege elevation in Microsoft 365 Copilot via an open redirect (CWE-601) lets an unauthenticated remote attacker abus
Command injection in Microsoft 365 Copilot allows an authenticated attacker with low privileges to execute arbitrary cod
Information disclosure in Microsoft 365 Copilot lets a remote, unauthenticated attacker reach a security-critical functi
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today