What is the CVSS score of CVE-2026-55145?

CVE-2026-55145 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.4%.

Which versions of Microsoft Copilot are affected by CVE-2026-55145?

Microsoft Outlook Copilot contains a command injection vulnerability (CVSS 7.1) that allows authenticated users with low privileges to compromise service confidentiality and integrity through…. A patch is available.

How to fix or mitigate CVE-2026-55145?

Within 24 hours, confirm that a patch available per vendor advisory for CVE-2026-55145 is accessible and identify all systems running affected Outlook Copilot versions. Within 7 days, deploy the patch across all user-facing Outlook Copilot deployments, prioritizing systems with access to sensitive email data. Within 30 days, verify patch deployment completion through automated scanning, validate functionality post-patch, and document remediation efforts for audit compliance.

Microsoft Copilot CVE-2026-55145

EUVD-2026-44226 HIGH

Command Injection (CWE-77)

2026-07-14 microsoft

GHSA-534g-wpcr-fm9q

Command Injection Microsoft Microsoft Copilot

7.1

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

MEDIUM

qualitative

NVD

7.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Network-reachable service needing an authenticated low-privileged account (PR:L), no user interaction, low complexity; command injection yields high confidentiality but only limited integrity and no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Updated

Jul 22, 2026 - 16:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 22, 2026 - 16:37 vuln.today

cvss_changed

Severity Changed

Jul 22, 2026 - 16:37 NVD

MEDIUM HIGH

CVSS changed

Jul 22, 2026 - 16:37 NVD

6.3 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Jul 22, 2026 - 16:35 vuln.today

CVE Published

Jul 14, 2026 - 17:09 cve.org

MEDIUM 6.3

DescriptionNVD

Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network.

AnalysisAI

Command injection in Outlook Copilot (Microsoft Copilot) lets an authenticated, low-privileged attacker inject unneutralized special elements over the network to tamper with the service, with Microsoft's CVSS rating a high confidentiality impact alongside limited integrity impact. The flaw was reported and fixed by Microsoft (MSRC CVE-2026-55145) and carries a CVSS 3.1 base score of 7.1. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none.

Technical ContextAI

The affected component is Microsoft Copilot as surfaced within Outlook, the AI assistant integrated into Microsoft 365. The root cause is CWE-77, improper neutralization of special elements used in a command, meaning attacker-supplied input reaches a command-processing context where special characters are not sanitized, allowing the input to alter the intended command. In an AI-assistant context this class typically arises where natural-language or structured user input is passed into downstream tooling, plugin invocations, or backend command interpreters without adequate escaping. The single CPE identified, cpe:2.3:a:microsoft:microsoft_copilot:*:*:*:*:*:*:*:*, indicates the Microsoft Copilot application/service itself rather than a specific on-premises version, consistent with a cloud-delivered service.

RemediationAI

Patch available per vendor advisory: Microsoft reports a fix is available and, as a cloud-delivered service, remediation is largely applied service-side by Microsoft - administrators should confirm their tenant reflects the fix and review the MSRC guidance at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55145 for any customer-side action or client update required. Because exploitation requires an authenticated low-privileged account, compensating controls include tightening account governance and enforcing multi-factor authentication to reduce the pool of accounts that could abuse the flaw, and restricting or auditing Copilot access for users who do not require it (trade-off: reduced productivity for those users). Monitor Outlook/Copilot audit logs for anomalous assistant activity while the fix propagates. Do not defer solely on the low EPSS score given the high confidentiality impact.