EUVD-2026-34335
GHSA-96wf-4fpw-9pw8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable Copilot service (AV:N), low complexity and no user interaction, but requires an authenticated low-privilege identity (PR:L); command injection yields total C/I/A impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.
AnalysisAI
Command injection in Microsoft 365 Copilot allows an authenticated attacker with low privileges to execute arbitrary code over a network, achieving full compromise of confidentiality, integrity, and availability (CVSS 8.8). The flaw stems from improper neutralization of special elements passed into a command context (CWE-77), meaning attacker-influenced input reaches a command interpreter. There is no public exploit identified at time of analysis and EPSS is very low (0.08%, 25th percentile), but the total technical impact and Microsoft-confirmed patch make this a meaningful priority for tenants using Copilot.
Technical ContextAI
Microsoft 365 Copilot is the generative-AI assistant layer embedded across the Microsoft 365 suite (Word, Excel, Outlook, Teams, and Graph-connected services), which processes natural-language prompts and orchestrates backend actions and connectors on the user's behalf. The affected component per CPE is cpe:2.3:a:microsoft:microsoft_365_copilot, a cloud-delivered SaaS product rather than an on-premises binary. The root cause is CWE-77 (Improper Neutralization of Special Elements used in a Command / 'Command Injection'): user- or attacker-supplied input is incorporated into a command that is executed by a downstream interpreter without adequate sanitization or neutralization, so crafted special characters break out of the intended data context and are interpreted as command syntax. In an AI-assistant context this class of flaw is frequently reachable through the prompt/tool-invocation pipeline, where model-mediated input can be marshaled into a command or API execution path.
RemediationAI
Patch available per vendor advisory: Microsoft has released a fix, and because Microsoft 365 Copilot is a cloud service the remediation is applied server-side by Microsoft rather than requiring customer-installed updates - review and confirm your tenant status via the Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45497. No customer-installed version number is published for this SaaS fix, so do not expect a KB/build to deploy. As compensating controls while validating remediation, restrict Copilot licensing and access to only users who need it, tighten conditional-access and MFA on accounts that hold Copilot entitlements (the flaw needs PR:L authenticated access, so account hardening directly shrinks the attack surface), and audit Copilot connector/agent permissions and Graph-connected data sources to limit blast radius; the trade-off is reduced Copilot availability and productivity for restricted users. Monitor sign-in and Copilot activity logs for anomalous prompt or connector activity from low-privilege accounts.
More in Microsoft 365 Copilot
View allInformation disclosure in Microsoft 365 Copilot allows remote unauthenticated attackers to exfiltrate data via command i
Remote code execution in Microsoft 365 Copilot allows an authenticated attacker to run arbitrary code over the network b
Privilege elevation in Microsoft 365 Copilot arises from an open redirect (CWE-601) that lets an unauthenticated remote
Privilege elevation in Microsoft 365 Copilot via an open redirect (CWE-601) lets an unauthenticated remote attacker abus
Information disclosure in Microsoft 365 Copilot lets a remote, unauthenticated attacker reach a security-critical functi
Information disclosure in Microsoft 365 Copilot lets an unauthorized remote attacker inject specially crafted command el
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today