EUVD-2026-70794
GHSA-r9hf-26xj-x88v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Copilot Studio endpoint over network
-
DeliveryForge token with invalid signature
-
ExploitService fails signature verification
-
ExecutionAssert elevated identity/role
-
PersistCross scope to other authority
-
ImpactAccess/control unauthorized resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Signature verification
|
| Exploitation Conditions | Exploitation requires network reachability to the Copilot Studio service endpoint that performs the flawed signature check, and the ability to present a crafted token (the 'Jwt Attack' tag points to a JWT). Per CVSS AV:N/AC:L/PR:N/UI:N no authentication, no user interaction, and no special access are needed, so the practical prerequisite is simply reaching the vulnerable service and supplying a token whose signature the service fails to verify correctly; the limiting factor is that only Microsoft's hosted Copilot Studio deployment is affected and the vulnerable code path is server-side, so once Microsoft remediates the service-side flow the condition no longer holds for tenants. |
| Impact | The signals conflict and must be weighed carefully. CVSS is a maximal 10.0 (AV:N/AC:L/PR:N/UI:N/S:C, all impacts High) and SSVC marks the technical impact as 'total' with automatable 'yes', which argues for treating this as a top-priority remediation. Against that, SSVC exploitation is 'none', EPSS is only 0.29% (22nd percentile), there is no CISA KEV listing, and no public exploit was identified - so this is a critical-by-design but not-yet-widely-exploited issue. For a cloud SaaS the practical mitigation burden is largely on Microsoft's side rather than on customers, which tempers customer-side urgency somewhat; nonetheless, because signature-verification bypasses are automatable and can be trivially scripted once details leak, any organization running Copilot Studio agents should confirm Microsoft's service-side fix is applied and monitor for anomalous privileged actions rather than wait for EPSS to climb. |
| Exploit ScenarioDerived | An unauthenticated attacker on the network crafts a token with a forged or unverified signature and submits it to a Copilot Studio endpoint that fails to properly validate the signature (CWE-347). The service accepts the forged identity/role, granting the attacker elevated privileges that cross into another security scope (S:C), allowing access to or control over resources they should not reach. No public proof-of-concept has been identified, but SSVC marks the attack as automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 08, 2026
Privilege elevation in Microsoft Copilot Studio lets a network-based, unauthenticated attacker bypass cryptographic signature verification (CWE-347) to gain elevated privileges across a scope boundary, per CVSS:3.1 AV:N/PR:N/S:C rated 10.0. The flaw appears to involve forged or improperly validated JWT tokens, per the 'Jwt Attack' tagging, and because Copilot Studio is a multi-tenant cloud service the scope-change vector implies impact beyond the initially compromised authority. No public exploit identified at time of analysis, and EPSS is low at 0.29% (22nd percentile), but SSVC rates technical impact as total and automatable as yes.
Earlier versions of this analysis (1)
Privilege escalation in Microsoft Copilot Studio lets an unauthenticated network attacker forge or replay authentication material because the service fails to properly verify a cryptographic signature (CWE-347). The 'Jwt Attack' tag indicates the flaw centers on JWT signature validation, allowing token spoofing that elevates privileges across the multi-tenant cloud service (scope change). Microsoft rates it 9.3 Critical; no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Because Copilot Studio is a Microsoft-operated cloud service, the fix is delivered service-side by Microsoft; consult the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-80098 to confirm the mitigation is deployed and whether any tenant-side action is required - Patch available per vendor advisory, with no discrete customer-installable version published. As compensating controls while confirming remediation, review Copilot Studio and Power Platform audit logs for unexpected privilege grants or agent actions, tighten conditional-access and network restrictions around who can reach the service, rotate any long-lived tokens or connection secrets used by agents, and enforce least-privilege on the identities that agents run under; the trade-off of tighter conditional access is potential disruption to legitimate low-code developers and automated agent flows.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Copilot Studio is Microsoft's low-code platform for building custom AI agents/copilots over the Power Platform, exposed as a network-accessible SaaS (cpe:2.3:a:microsoft:copilot_studio). CWE-347 (Improper Verification of Cryptographic Signature) is the root cause: the service accepts a security token - consistent with the 'Jwt Attack' tag, most plausibly a JWT - without correctly validating its signature. When signature validation is weak (e.g. accepting 'alg: none', failing to verify against the trusted signing key, or confusing symmetric/asymmetric keys), an attacker can mint or tamper with a token to assert an identity or role they do not legitimately hold, yielding privilege elevation. The CVSS S:C (scope changed) reflects that a break in the authenticating component's guarantees propagates to resources under a different security authority - characteristic of token-forgery bugs in shared, multi-tenant identity flows.
Know when Copilot Studio gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Network-reachable service accepting a forged token needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); token forgery in a multi-tenant service crosses scope (S:C) with full C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Copilot Studio contains a critical privilege elevation vulnerability (CVSS 10.0) allowing unauthenticated attackers to forge authentication tokens and gain elevated privileges across customer tenants in the shared cloud environment. All organizations using Copilot Studio are exposed to complete account compromise and unauthorized access to sensitive business data and integrations without any authentication requirement. This represents one of the most severe cloud service vulnerabilities, with no patch currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network access to Copilot Studio via IP whitelisting and mandatory VPN requirement; enforce multi-factor authentication for all administrative users; implement approval workflows for privilege escalation requests; audit and disconnect integrations to production systems; establish real-time monitoring for cryptographic validation anomalies and unusual privilege escalation patterns; maintain comprehensive audit logging of all administrative activity for forensic investigation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Copilot Studio
View allImproper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorize
Unauthenticated attackers can remotely access sensitive information in Microsoft Copilot Studio due to improper access c
Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view s
An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak s
Exploit-DB