EUVD-2026-48457
GHSA-cfm3-7vpc-px47
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable RCE needing only a low-privilege authenticated identity (PR:L), no user interaction, with a cloud service scope change (S:C) and full CIA impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
AnalysisAI
Remote code execution in Microsoft 365 Copilot allows an authenticated attacker to run arbitrary code over the network by supplying maliciously crafted serialized data (CWE-502). The flaw carries a CVSS 9.9 rating driven by a scope change and full confidentiality, integrity, and availability impact, and because Copilot is a Microsoft-hosted cloud service, exploitation would affect the shared multi-tenant platform. No public exploit identified at time of analysis (CVSS exploit maturity is Unproven), but a vendor fix has been released via MSRC.
Technical ContextAI
The vulnerability is a CWE-502 unsafe deserialization of untrusted data within Microsoft 365 Copilot (CPE cpe:2.3:a:microsoft:microsoft_365_copilot). Deserialization flaws occur when an application reconstructs objects from attacker-influenced byte streams without validating type or content, allowing an attacker to instantiate unexpected object graphs that trigger code execution during or after the deserialization process (gadget chains). As a Microsoft-hosted SaaS AI assistant integrated across the M365 suite, Copilot ingests and processes structured data from many connected sources, and the CVSS scope-change flag (S:C) indicates that exploiting the vulnerable component can impact resources beyond its own security authority - consistent with a shared cloud service boundary.
RemediationAI
Patch available per vendor advisory: Microsoft has released a fix, and because Microsoft 365 Copilot is a Microsoft-hosted cloud service the remediation is applied server-side by Microsoft, so no customer-installed update is typically required - verify remediation status and any required tenant actions via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50517. As compensating measures pending confirmation of full mitigation, restrict Copilot access to only the users and connectors that require it, review and minimize third-party data connectors and plugins that feed untrusted serialized content into Copilot, and monitor audit logs for anomalous Copilot activity from low-privilege accounts. The trade-off of tightly scoping connectors is reduced Copilot functionality and data reach for end users.
More in Microsoft 365 Copilot
View allInformation disclosure in Microsoft 365 Copilot allows remote unauthenticated attackers to exfiltrate data via command i
Privilege elevation in Microsoft 365 Copilot arises from an open redirect (CWE-601) that lets an unauthenticated remote
Privilege elevation in Microsoft 365 Copilot via an open redirect (CWE-601) lets an unauthenticated remote attacker abus
Command injection in Microsoft 365 Copilot allows an authenticated attacker with low privileges to execute arbitrary cod
Information disclosure in Microsoft 365 Copilot lets a remote, unauthenticated attacker reach a security-critical functi
Information disclosure in Microsoft 365 Copilot lets an unauthorized remote attacker inject specially crafted command el
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today